PHP security update fixes two actively targeted RCE flaws
A PHP security update addresses two critical vulnerabilities that could let an unauthenticated attacker run code on a web server. Remote code execution (RCE) means an attacker can make the affected system execute commands without first signing in. The flaws, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2, and Sucuri reported on October 21, 2026 that exploitation attempts were already being observed.
PHP has released four fixed versions: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Administrators running their own server or virtual private server should install the appropriate release through their operating system, package provider, control panel or established deployment process. Customers of shared or managed hosting should confirm that their provider has installed a fixed PHP build or a package containing an explicit vendor backport of the fixes.
These are vulnerabilities in the PHP runtime, the server software that executes PHP applications, rather than in WordPress, another content management system, a plugin or a theme. Updating WordPress core and its extensions therefore does not remove the vulnerable server behavior. According to the advisory, any PHP installation serving web requests should be treated as potentially exposed, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest-risk configuration because a demonstrated exploit can be triggered by an unauthenticated request before the website's application code starts running.
CVE-2026-109618 concerns an out-of-memory condition, which occurs when a process cannot obtain the memory it needs. PHP can be interrupted while internal request data is only partly initialized. During cleanup, it may mistake that incomplete data for valid information, corrupt memory and potentially permit remote code execution.
CVE-2026-109619 involves stale internal state. A PHP worker, a process that handles website requests, may keep a reference to request data after the underlying memory has been released. A later request processed by that same worker can reach the stale information before PHP resets it. The result could be disclosure of information or remote code execution.
Public proof-of-concept code, which demonstrates how a vulnerability can be triggered, circulated before the official fixes appeared. Hadrian said it was seeing PHP2Shell exploitation at scale and reported that much of the observed activity abused PHP's session upload-progress path. It also warned that further exploitation paths were likely to emerge. WatchTowr, Patchstack, Cloudflare and Vega separately reported malicious activity or attempts connected with the flaws. An attempted exploit does not by itself prove that a server was successfully compromised, but the public code and volume of activity make prompt patching important.
After installing the PHP security update, administrators must restart or reload PHP workers and any related services so that the running processes use the new build. They should then verify the version that is actually serving the live website. The version displayed by the command-line instruction php -v can differ from the one used by the web server. Testing should cover logins, checkout, forms, file uploads, scheduled tasks, application programming interfaces (APIs) and administrative pages.
Sites using PHP 8.1 or older require extra care. Those branches are outside PHP's normal support cycle and will not receive standard upstream point releases. Because these flaws are severe, PHP published emergency source backports for PHP 7.4, PHP 8.0 and PHP 8.1, while Linux distributions and long-term-support vendors may provide patched packages of their own. A displayed version number is not enough to establish whether an older installation is safe because vendors can apply a security fix without changing the branch number. Administrators must confirm that the installed package specifically addresses both CVE identifiers. These emergency backports do not restore long-term support, so moving to a supported PHP branch remains the safer long-term course.
Sucuri said its web application firewall (WAF), a filtering layer that examines requests before they reach a website, was already blocking some malicious patterns associated with the vulnerabilities. It has added more targeted virtual-patching rules for known PHP2Shell paths. These filters can reduce exposure while an update is being deployed, but they do not correct PHP itself and can only block requests they recognize. PHP states that installing a patched build is the only complete solution.
Firewall filtering also depends on traffic passing through it. If an attacker can connect directly to the origin server, the computer that actually hosts the site, filtering rules can be bypassed. Administrators using Sucuri's WAF should restrict direct IPv4 and IPv6 access, accept web traffic only from approved Sucuri Firewall addresses, and remove old DNS records or alternate hostnames that reveal the origin. Staging, development, test and backup environments also need protection or access restrictions. Teams should check that unprotected subdomains and alternate ports do not expose the same application, and that old containers, server images or autoscaling templates are not continuing to deploy vulnerable PHP builds.
If patching cannot happen immediately, disabling session upload progress at server level with `session.upload_progress.enabled = Off` can reduce exposure to confirmed session-related routes for CVE-2026-109619. The setting must be applied through php.ini, an FPM pool or another configuration loaded before request parsing, followed by a restart of every affected PHP worker. This is only a temporary measure: it does not cover every route to CVE-2026-109619, does nothing against CVE-2026-109618 and may affect applications that display PHP upload progress. PHP has also provided temporary guidance for the out-of-memory route in its full advisory, but no workaround makes an unpatched installation safe.
Administrators should investigate unfamiliar PHP files, unexpected scheduled tasks, unknown administrator accounts, suspicious outbound connections and unusual upload-related requests. For WordPress owners who prefer specialist site operations rather than managing everything alone, AEU Hosting offers managed WordPress hosting secured end to end; regardless of provider, owners should still confirm that the live PHP build contains both fixes. The immediate priorities are to install a fixed release or confirmed backport, restart PHP, verify the live web version and ensure any firewall cannot be bypassed through direct access to the origin.