TechAtelier

CYBERSECURITY · OCTOBER 22, 2026

PHP: two critical vulnerabilities fixed — how to secure your web server

Two critical PHP flaws may allow unauthenticated remote code execution. Security releases have been available since October 21.

What the PHP team confirmed

CVE-2026-109618 affects out-of-memory handling: partially initialized request data may be misinterpreted during cleanup. CVE-2026-109619 involves stale internal state retained after the underlying memory has been freed, potentially reused on a subsequent request. Both are rated 9.2/10 (CVSS 4.0) and may enable unauthenticated remote code execution.

The advisory covers PHP serving web requests via PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. PHP considers mod_php particularly high risk and reports a demonstrated exploit. This does not establish that every vulnerable website was compromised.

Fixed PHP versions

  • PHP 8.2: 8.2.35
  • PHP 8.3: 8.3.36
  • PHP 8.4: 8.4.27
  • PHP 8.5: 8.5.12

PHP 8.1 and older are no longer maintained upstream. Upgrade to a supported branch or confirm a vendor backport. Linux distributions may backport patches without adopting upstream version numbers. PHP 8.2 reaches end of life on December 31, 2026.

Check the actual runtime

Running php -v on a host does not necessarily identify the PHP version used by a Docker-hosted website. Inspect the PHP images and processes inside containers. Read-only commands:

php -v
docker compose ps
docker compose exec -T SERVICE_NAME php -v

Replace SERVICE_NAME with the relevant PHP service. Also check distribution package advisories.

A safe patching plan

  1. Inventory PHP processes serving public requests, including containers.
  2. Identify the fixed upstream version or a vendor-confirmed backport.
  3. Back up data and test in staging.
  4. Update packages or rebuild images with a patched base and redeploy.
  5. Verify patches inside the newly running processes, inspect logs and run application tests.

Restarting a container still based on a vulnerable image is not a fix. PHP warns that configuration-only mitigations are incomplete: upgrading is necessary.

What about past exposure?

Review logs, anomalies and indicators of compromise according to actual exposure. A vulnerable version does not prove an intrusion; patching does not erase a prior compromise.

Use TechAtelier Software Watch to help track software components.

Official source

PHP security advisory — October 21, 2026.