Critical PHP Vulnerabilities in October 2026: What Happened, Who Is Affected & How to Fix Them

What Happened to PHP on October 21, 2026?

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. Both received a CVSS v4.0 severity score of 9.2 (Critical). Under certain conditions, attackers may exploit these issues to execute code remotely without first authenticating. These weaknesses affect the PHP engine itself, not simply one WordPress plugin, Laravel package, or individual website.

Action required: Upgrade to a patched release of your supported PHP branch: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, or PHP 8.2.35 (or newer vendor-fixed builds). PHP 8.5.11 and PHP 8.3.35 do not contain the October 21 fixes. PHP 8.1 and older are no longer maintained upstream; ask your vendor about supported backports or migrate to a supported branch.

What Are the Two PHP Vulnerabilities?

1. CVE-2026-109618: Out-of-Memory Corruption

During some out-of-memory situations, PHP can leave internal request data only partially initialized. Cleanup can then interpret invalid data as legitimate state, potentially corrupting memory. The PHP Foundation reported demonstrated unauthenticated remote code execution with Apache mod_php under default settings; PHP-FPM exploitation was also confirmed through application-level paths.

2. CVE-2026-109619: Stale State and Use-After-Free

A fatal error can leave PHP's internal request state referencing already-freed memory. A subsequent request handled by the same worker may interact with that stale state, causing a crash or potentially allowing code execution. Researchers demonstrated remote code execution against a real application using Apache mod_php.

These issues affect PHP installations serving web requests—including Apache/mod_php, PHP-FPM, php-cgi, LiteSpeed and other supported integration methods. Not every vulnerable server is equally exploitable; the attack path depends on configuration and application behavior. However, a firewall rule or web application update alone is not a complete fix.

When Were the Vulnerabilities Discovered, and How Were They Fixed?

• 2024: During follow-up work on an externally commissioned PHP security audit, a PHP core developer noticed early signs of the out-of-memory problem. At the time, the team had not established a concrete remote-code-execution path.
• July 30, 2026: Security firm Calif began a PHP audit through the Patch the Planet program.
• August 11, 2026: Calif researcher Ryan A and OpenAI independently reported a remote-code-execution pathway related to the previously identified root cause. Wiz and other researchers subsequently provided additional findings.
• August–October 2026: PHP maintainers worked on fixes, tested compatibility and coordinated releases with distributors. The PHP Foundation acknowledged that resource limits and a slow security decision-making process had delayed an earlier resolution.
• October 20, 2026: CVE identifiers appeared publicly before the coordinated announcement, prompting the team to accelerate disclosure. A mistaken score of 10.0 circulated; the official score is 9.2.
• October 21, 2026: PHP released the patched versions, with fixes across all currently supported branches.

The PHP Foundation described changes to its security workflow, including greater dedicated security staffing, improved triage and cooperation with researchers. Its response also highlighted the use of AI-assisted research tools alongside human review—not an automatic AI-generated patch.

What Does This Mean for Websites, Businesses and Hosting Providers?

PHP powers many content management systems, e-commerce platforms and custom applications. Consequently, a serious bug in the core runtime can create potential exposure across many industries: retail, healthcare, education, financial services, government, and SaaS. The disclosure prompted emergency maintenance and precautionary website shutdowns, including reports of government services temporarily going offline. A site being unavailable during this incident does not necessarily mean it was compromised: some organizations intentionally disabled services while patching.

For affected organizations, possible consequences include unauthorized code execution, sensitive-data exposure, data alteration, service disruption, emergency downtime and recovery expenses. Those are possible outcomes, not evidence that every PHP website was attacked. Publicly available reports do not establish a reliable global count of successfully compromised websites or a defensible total financial loss from this incident.

Which PHP Versions Are Safe to Run?

Important: A major-version upgrade is not required solely to resolve this incident if your current supported branch has a security release. A patched PHP 8.3.36 installation is preferable to an unpatched PHP 8.5.11 installation.

How to Update PHP on Shared Web Hosting (cPanel, Plesk and Similar Panels)

1. Back up your website files, database, configuration and email-related settings as appropriate.
2. Log in to your hosting control panel. Look for Select PHP Version, MultiPHP Manager, PHP Settings or an equivalent feature.
3. Check the exact PHP patch version, not merely the major/minor selection. Choosing “8.5” does not prove that your host has deployed 8.5.12 or newer.
4. Select a supported patched runtime once your hosting provider confirms it, then apply the change.
5. Test login, checkout, forms, uploads, scheduled tasks and third-party integrations. For WordPress, also update WordPress core, themes and plugins; for Laravel, validate Composer requirements.
6. If the control panel cannot confirm a fixed build, contact hosting support urgently. Shared-hosting customers generally cannot independently replace system PHP binaries.

Managed hosts may distribute backported security fixes under their own version strings. Ask for the vendor's confirmation that the two CVEs are fixed instead of judging only by the upstream version number.

How to Patch a PHP VPS on Ubuntu 24.04 With Nginx and PHP-FPM

For a VPS you administer, first take a server snapshot and verify the available package versions. The following is an example for Ubuntu 24.04 using the Ondřej PHP PPA. Do not switch your live sites to an unpatched PHP 8.5.11 build.

sudo apt update
apt-cache policy php8.5-fpm php8.3-fpm
php8.5 -v

If PHP 8.5 is installed and your repository offers a fixed release, upgrade the installed packages:

sudo apt install --only-upgrade php8.5-cli php8.5-fpm php8.5-common
sudo systemctl restart php8.5-fpm
php8.5 -v

The output must show 8.5.12 or a newer fixed package (or an explicitly confirmed vendor-backported package). If the required version is not available, check repository synchronization and vendor guidance; do not assume an older build is safe.

If you are upgrading from PHP 8.3 to PHP 8.5, install PHP 8.5 and all application-required extensions alongside PHP 8.3, review PHP configuration and PHP-FPM pools, then test application compatibility before changing Nginx. For example, a site's Nginx configuration may use:

fastcgi_pass unix:/run/php/php8.3-fpm.sock;

After you have verified PHP 8.5.12+ and tested your application, that site can be switched to:

fastcgi_pass unix:/run/php/php8.5-fpm.sock;

Validate and reload Nginx:

sudo nginx -t && sudo systemctl reload nginx

Test each website separately. Also check background jobs, cron, Supervisor queue workers, Composer dependencies and CLI PHP settings; changing the web socket alone does not update every PHP process. Keep the previous supported and patched PHP version available for rollback while testing.

What if Your VPS Is Still Running PHP 8.3?

You do not need PHP 8.5 specifically for this security fix. If compatibility makes a major upgrade risky, update the PHP 8.3 packages to 8.3.36 or later from a trustworthy repository and restart PHP-FPM. Test the site, verify the active web runtime, and schedule a separate major-version migration.

What Happens if You Do Not Apply the Patch?

An unpatched server may remain exposed to attacker-controlled requests that trigger vulnerable memory-management paths. Depending on the application, attack conditions and privileges of the PHP process, successful exploitation could cause crashes, application downtime, malicious code execution, unauthorized access to data, or further compromise. The risk is not eliminated by an updated WordPress plugin, a CDN or a web application firewall.

If immediate updates are genuinely impossible, use the official PHP advisory's temporary exposure-reduction guidance and consider isolating or temporarily disabling high-risk public endpoints. These steps are not a substitute for patching. If compromise is suspected, preserve logs and evidence, investigate, and rotate credentials after containment rather than assuming that installing an update removes an existing intrusion.

Quick Post-Update Security Checklist

• Confirm your web-served PHP runtime is patched; php -v only checks the CLI runtime.
• Restart PHP-FPM/Apache workers and rebuild or redeploy PHP-based containers if applicable.
• Check your application and dependency compatibility, backups, logs and monitoring.
• Update Laravel/WordPress dependencies, operating-system packages and exposed services independently.
• Review unusual activity around the disclosure window; patching fixes a vulnerability but does not prove that past exploitation did not occur.
• Set reminders for future security releases and retire unsupported PHP versions.

Frequently Asked Questions

Is PHP 8.5.11 safe from the October 2026 vulnerabilities?

No. PHP 8.5.11 predates the October 21 security release. Upgrade to PHP 8.5.12 or newer.

Is PHP 8.3 affected?

Yes, earlier PHP 8.3 builds are affected. PHP 8.3.36 and later incorporate the fixes.

Does Cloudflare or a firewall completely prevent these attacks?

No. Network controls can reduce exposure, but the PHP maintainers state that updating is the only complete fix.

Do all websites need to move to PHP 8.5?

No. A fixed supported branch, such as PHP 8.3.36 or 8.4.27, can address these CVEs. Major-version migrations should also consider application compatibility and long-term support.

Were offline websites necessarily hacked?

No. Some organizations intentionally took public services offline during emergency maintenance. Downtime alone is not evidence of compromise.

Final Thoughts: Patch the Runtime, Then Verify the Application

The October 2026 incident is a reminder that security issues can exist below the application framework, inside the runtime itself. For business websites, Laravel systems and WordPress installations, the practical response is straightforward: identify the active PHP version, apply the confirmed vendor fix, restart or redeploy the runtime, and test your application.

At ZerithonLabs, we work with PHP, Laravel and production server deployments. If your business needs help assessing PHP runtime exposure, planning a safe upgrade or hardening a VPS, contact our team to discuss a scoped security review.

Need Help With PHP, WordPress or Laravel Updates?

Is your website running an outdated PHP version, WordPress installation, Laravel framework, or custom PHP application? Don't let security vulnerabilities, compatibility issues, or outdated software put your business at risk.

At ZerithonLabs, we provide professional PHP upgrade services, WordPress maintenance, Laravel version upgrades, Core PHP application modernization, and VPS server security updates for businesses worldwide.

How We Can Help

• PHP Version Upgrades: PHP 8.3, 8.4, 8.5 and supported security releases.
• WordPress Updates: WordPress core, themes, plugins, security fixes and compatibility testing.
• Laravel Upgrades: Laravel framework updates, Composer dependencies, PHP compatibility and bug fixes.
• Core PHP / Raw PHP: Legacy PHP application upgrades, code modernization and compatibility fixes.
• VPS & Server Security: Ubuntu, Nginx, Apache, PHP-FPM and server configuration updates.
• Shared Hosting Support: PHP version changes, cPanel configuration, migration and troubleshooting.
• Website Recovery: Resolving PHP errors, update-related downtime and application compatibility issues.

Whether you have a small WordPress business website, a Laravel SaaS platform, or a custom PHP application, our developers can help plan and implement a safe upgrade with backups, compatibility testing, and rollback preparation.

Get Professional PHP & Website Upgrade Support

Not sure which PHP version your website uses? Experiencing errors after an update? Contact our team to discuss your website's security, application upgrade, or server maintenance requirements.

Chat on WhatsApp → Send Us an Email → Request Technical Support →

Email: hello@zerithonlabs.com

WhatsApp: +880 1723-177901

ZerithonLabs — PHP Upgrade Services | WordPress Maintenance | Laravel Development | VPS Server Security | Website Support. Based in Bangladesh, serving businesses and agencies worldwide.

Sources and Further Reading

• PHP official October 21, 2026 security advisory
• PHP Foundation: How the vulnerabilities were found and fixed
• Google Cloud: Technical description and response
• PHP 8.5.12 release announcement