Published: 21 October 2026

Refference: https //www.php.net/

A critical PHP security update has been released, and website owners, website developers and server administrators using PHP should take immediate action.

On 21 October 2026, the PHP development team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical security vulnerabilities that can potentially allow an attacker to execute code remotely without authentication.

The vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.

PHP strongly recommends that users update immediately because there is no complete workaround that provides the same protection as installing the patched PHP version.

What Happened?

Two serious vulnerabilities were discovered in PHP's core request-handling processes.

Both vulnerabilities can potentially result in Remote Code Execution (RCE).

Remote Code Execution is one of the most serious types of server vulnerabilities because, under the right conditions, an attacker may be able to make a vulnerable server execute unauthorized code remotely.

Even more importantly, these vulnerabilities can potentially be exploited without requiring the attacker to log in first.

For businesses operating websites, web applications, ecommerce platforms, customer portals or other PHP-based systems, this makes the update particularly important.

Which PHP Versions Should You Update To?

Website owners should update to the latest patched release available for their PHP branch.

These releases contain fixes for both critical vulnerabilities.

PHP lists versions earlier than these patched releases as affected by the stale global-state vulnerability.

Which Websites and Servers Are at Risk?

The advisory is relevant to PHP installations that process web requests.

This includes websites running through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

The PHP security team considers Apache mod_php installations to carry particularly high risk, as an unauthenticated exploit has been demonstrated where the attack can occur before normal application code is executed.

This means the issue is not limited to a particular PHP framework, CMS or website application.

The vulnerabilities exist within PHP itself.

A WordPress website, custom PHP application, ecommerce system, CMS or business application could therefore be affected if it runs on a vulnerable PHP environment.

What Is CVE-2026-109618?

CVE-2026-109618 involves PHP's handling of out-of-memory conditions.

Under certain conditions, PHP can be interrupted while internal request information is only partially initialized. During request cleanup, invalid or incomplete information may then be treated as legitimate data.

A carefully constructed request may potentially take advantage of this condition and result in remote code execution.

The vulnerability has been classified as Critical, with the PHP advisory assigning it a CVSS 4.0 score of 9.2.

What Is CVE-2026-109619?

The second vulnerability, CVE-2026-109619, relates to stale global state being retained between PHP requests.

PHP workers maintain several types of internal state while processing requests. Under certain exceptional conditions, some state can remain after the memory associated with the previous request has already been released.

A later request handled by the same worker may then access this stale information before the normal initialization process replaces it.

Under carefully controlled conditions, an attacker may be able to manipulate this behaviour and achieve remote code execution.

PHP has also classified this vulnerability as Critical.

Why Remote Code Execution Is Serious

A normal website vulnerability may affect only a particular page, plugin or feature.

Remote Code Execution is different.

If successfully exploited, an RCE vulnerability could potentially allow unauthorized commands or code to run under the permissions available to the affected web worker.

Depending on the server configuration and other security controls, this could put website files, application data and the wider hosting environment at risk.

The existence of a vulnerability does not mean that every PHP website has already been compromised. However, because these vulnerabilities exist in the PHP runtime itself and can be triggered through web requests, delaying the security update unnecessarily increases exposure.

Are PHP 8.1 and Older Versions Safe?

No. Older PHP versions should not be assumed to be safe simply because they are no longer part of PHP's normal supported release branches.

PHP 8.1 and older versions no longer receive normal security releases from the PHP project.

Because of the seriousness of these vulnerabilities, the PHP security team has provided limited source backports for PHP 7.4, PHP 8.0 and PHP 8.1 to assist organizations that build PHP from source or depend on long-term-support vendors.

However, for most website owners, continuing to operate an outdated PHP version is not a good long-term security strategy.

Where application compatibility allows, migrating to a currently supported PHP release is recommended.

What Should Website Owners Do Now?

The most important action is straightforward: check the PHP version running your website and update it to a patched version immediately.

If your website is hosted through cPanel, Plesk, a managed hosting provider, VPS or cloud infrastructure, check which PHP version is currently assigned to the website.

Before changing a major PHP version on an older application, it is also sensible to take a complete backup and verify application compatibility.

For example, moving from an older unsupported PHP release directly to PHP 8.5 could expose compatibility issues in outdated website code, plugins or third-party libraries.

The security problem should therefore be addressed promptly, but the PHP upgrade should also be carried out carefully.

What If You Cannot Update PHP Immediately?

The official advisory provides temporary measures that can reduce exposure to particular attack paths.

However, PHP specifically warns that these measures do not make an affected installation completely safe.

For CVE-2026-109618, recommendations include adjusting PHP memory handling, limiting request sizes and applying appropriate operating-system or container-level memory controls.

For CVE-2026-109619, temporary protections include disabling session upload progress, restarting workers and, for PHP 8.5, disabling fatal error backtraces.

These are mitigation measures rather than replacements for the security update.

For most businesses, the safest approach is still to upgrade PHP as quickly as possible.

Don't Simply Change the PHP Version Without Testing

Security updates are urgent, but production websites also need to remain functional.

Before or immediately after upgrading PHP, important website functions should be tested.

A business website should be checked for page loading, enquiry forms, login functions, database connectivity and email delivery.

An ecommerce website requires additional testing of product pages, cart functionality, checkout, payment gateways, order processing, shipping integrations and customer notifications.

Custom PHP applications should also be checked for deprecated functions, third-party libraries and code that may behave differently in the newer PHP version.

A successful PHP security update therefore involves both patching the server and verifying the application.

Why Regular PHP Updates Matter

Many businesses update their website content regularly but overlook the software environment running behind the website.

PHP, database servers, web servers, CMS platforms, plugins, frameworks and third-party libraries all require ongoing maintenance.

Running an outdated PHP version can increase security risk, create compatibility problems and prevent applications from benefiting from newer performance and security improvements.

Security maintenance should therefore be treated as an ongoing part of website management rather than something addressed only after a critical vulnerability is announced.

PHP Security Checklist for Business Websites

After this security advisory, website owners should review their PHP environment, update to the relevant patched version, restart applicable PHP workers or services, test important website functionality, confirm that forms and transactions work correctly, review server and website logs for unusual activity, verify backups and make sure unsupported PHP versions are included in a future upgrade plan.

Businesses using managed servers should also confirm with their hosting or server management provider that the security patches have actually been installed rather than assuming that automatic updates have already taken place.

Need Help Updating Your PHP Website?

If you are unsure which PHP version your website uses or whether your existing website will work correctly after an upgrade, professional assistance can help reduce both security and compatibility risks.

Nikitha Web Development Pvt Ltd provides website development, maintenance and technical support for business websites and web applications.

Our team can help review your existing website environment, check PHP compatibility, coordinate the required PHP upgrade and test important website functionality after the update.

Secure Your PHP Website Today

Don't leave a business-critical website running on a vulnerable PHP version.

Contact Nikitha Web Development Pvt Ltd for PHP version upgrade and website security assistance.

CTA: Request PHP Security Update Assistance

Frequently Asked Questions

What is the latest PHP security update?

As of 21 October 2026, the PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 containing fixes for two critical remote code execution vulnerabilities.

Which PHP vulnerabilities were discovered?

The vulnerabilities are CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale global state.

Can these PHP vulnerabilities be exploited without login access?

Yes. The PHP security advisory states that the vulnerabilities can allow unauthenticated remote code execution under vulnerable conditions.

Is PHP 8.5.12 the latest secure PHP 8.5 version?

Yes. PHP 8.5.12 was released on 21 October 2026 as the security release addressing these two critical vulnerabilities.

Should I update from PHP 8.5.5 to PHP 8.5.12?

Yes. If your server is currently running PHP 8.5.5, it should be updated to PHP 8.5.12 rather than remaining on the older PHP 8.5 release.

Is PHP 8.4 affected?

Older PHP 8.4 releases are affected. The patched PHP 8.4 release is PHP 8.4.27.

Is PHP 8.3 affected?

Older PHP 8.3 releases are affected. The patched PHP 8.3 release is PHP 8.3.36.

Is PHP 8.2 affected?

Older PHP 8.2 releases are affected. The patched PHP 8.2 release is PHP 8.2.35.

What about PHP 8.1 and older versions?

PHP 8.1 and older versions no longer receive regular security releases from the PHP project. Limited source backports have been made available for PHP 7.4, 8.0 and 8.1 for these vulnerabilities, but businesses should consider migrating to a currently supported PHP release.

Will updating PHP affect my website?

It can, particularly when upgrading older websites across major PHP versions. Website code, CMS plugins, themes, frameworks or third-party libraries may require compatibility changes. Backups and functionality testing are recommended.

Can I protect my server without updating PHP?

The PHP team provides temporary mitigations that can reduce exposure to particular attack paths, but they are not considered complete solutions. Installing a patched PHP version remains the safest response.

How do I know which PHP version my website is using?

The version can usually be checked through your hosting control panel, server administration panel, command line or PHP configuration. If you use managed hosting, your hosting provider or website developer can also confirm the active PHP version.