PHP maintainers have released an urgent security update addressing two critical vulnerabilities that could allow an unauthenticated attacker to execute code remotely on a vulnerable server. The announcement was published on October 21, 2026, and the PHP development team is urging users to update immediately.
The vulnerabilities affect PHP itself, not just a particular framework or CMS. This makes the announcement relevant to teams maintaining PHP applications across different hosting environments, including WordPress, Laravel, custom PHP applications, and other web platforms.
According to the official PHP announcement, both vulnerabilities have a CVSS v4.0 severity score of 9.2.
What are the vulnerabilities?
The security release addresses two separate issues in PHP's internal request-handling mechanisms.
1. CVE-2026-109618: Remote code execution through out-of-memory corruption
This vulnerability involves PHP's handling of an out-of-memory (OOM) condition.
When PHP encounters a memory allocation failure, it can interrupt processing while internal request data is only partially initialized. During subsequent cleanup, PHP may incorrectly treat this incomplete data as valid.
Under the conditions described in the advisory, this can lead to remote code execution.
The important point for server administrators is that this issue concerns PHP's internal handling of a failure condition. It is not necessarily something that can be corrected by changing application code or updating a WordPress plugin.
2. CVE-2026-109619: Remote code execution through stale global state
The second vulnerability concerns internal state that belongs to a previous request.
PHP may retain a reference to request-related state after the memory backing that state has been freed. A later request handled by the same worker can then encounter this stale state before normal initialization resets it.
This creates a potential path to remote code execution.
The issue is particularly relevant when PHP workers process multiple requests over their lifetime, making the way internal state is managed important to the security of the runtime.
Both vulnerabilities are addressed by the security releases announced by the PHP development team on October 21, 2026.
Which PHP versions are affected, and what should you install?
The official announcement identifies PHP installations serving web requests as being at risk. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The PHP team identifies Apache's mod_php configuration as the highest-risk configuration, including a demonstrated exploit in which an unauthenticated request can trigger the attack before application code runs.
The following releases contain the fixes:
Official PHP Fixed Versions
PHP 8.5: Upgrade to version 8.5.12 or later.
PHP 8.4: Upgrade to version 8.4.27 or later.
PHP 8.3: Upgrade to version 8.3.36 or later.
PHP 8.2: Upgrade to version 8.2.35 or later.
PHP 8.1, 8.0, and 7.4: These branches no longer receive regular upstream security updates. Check your Linux distribution or long-term-support vendor for patched packages, or plan an upgrade to a supported PHP branch.
Always verify the installed package against your vendor's security advisory, as some vendors backport security fixes without changing the upstream PHP version number.
If your application runs one of these branches, upgrade to the corresponding fixed version or a later release containing the security fixes.
Do not assume that updating to the latest version of your CMS, framework, or plugins resolves the problem. The vulnerability exists in the PHP runtime itself.
What about PHP 8.1, PHP 8.0, and PHP 7.4?
These branches no longer receive regular updates from the PHP project. The PHP security team has provided minimal source backports for PHP 7.4, 8.0, and 8.1 to help users who build PHP from source or do not have access to a long-term-support vendor.
Some Linux distributions and LTS vendors have also received patches and may provide updated packages for older branches.
If you are running an older PHP version, check your distribution's official security advisory or contact your hosting provider to establish whether a patched package is available. Where possible, plan an upgrade to a currently supported PHP branch.
There is an additional deadline to consider for PHP 8.2: its scheduled end of life is December 31, 2026. Although version 8.2.35 addresses these vulnerabilities, teams should plan for the branch's upcoming end of security support.
What should server administrators do now?
For teams managing multiple websites or production servers, the first step is to identify which PHP runtime each application actually uses.
A server can have several PHP versions installed simultaneously. The version reported by the command line is not necessarily the same version serving requests for a particular website.
Start by checking the command-line version:
php -vOn Linux servers, you can also inspect the available PHP-FPM services and installed packages. The exact commands depend on the operating system and how PHP was installed.
For each application, establish:
The PHP version used by the web server.
Whether it runs through PHP-FPM, mod_php, CGI, or another handler.
Whether the installed package includes the security fixes.
Whether the PHP branch remains supported by the PHP project or its vendor.
Once the appropriate update is available, apply it through your operating system's package manager, hosting control panel, or established PHP deployment process.
After the upgrade, restart the relevant PHP workers or services as required and verify that the patched runtime is serving requests. Test important application functionality, particularly integrations, file uploads, background jobs, and other features that depend on PHP.
For systems running PHP from source, use the official release downloads and follow the appropriate build and deployment procedure.
Can the vulnerability be mitigated without upgrading?
The official advisory provides temporary measures that reduce exposure to specific attack paths. However, it explicitly warns that these measures do not make an installation safe.
Depending on the vulnerability and PHP version, the guidance includes adjusting memory-limit handling, restricting request sizes, disabling session upload progress, and addressing certain error-handling paths.
These settings require care. For example, changing PHP's memory-limit configuration can affect application availability and resource consumption, while disabling session upload progress may affect applications that rely on it.
Temporary mitigations should therefore be applied only after reviewing the official instructions and understanding their impact on the application.
The PHP security team's position is clear: updating is the only complete solution. Configuration changes should not be treated as a substitute for installing the security fixes.
Why this matters for WordPress, Laravel, and custom PHP applications
Because these vulnerabilities affect PHP's runtime, the security review should cover every application that uses PHP to serve web requests.
For WordPress sites, updating WordPress core, themes, and plugins is not sufficient to address a vulnerability in the PHP engine.
For Laravel and other PHP frameworks, the same principle applies. Application-level security practices remain important, but they cannot independently correct a flaw in the underlying runtime.
Teams managing hosting infrastructure should also consider less visible environments, including staging sites, older client projects, legacy applications, and servers where multiple PHP versions are configured.
An inventory of websites alone may not be enough. The team needs to identify the PHP handler and runtime actually used by each site.
Final recommendation
The October 21 PHP security release is a reminder that maintaining a secure web application involves more than keeping application dependencies up to date. The runtime and hosting environment need regular attention as well.
If you manage PHP-based websites or infrastructure, review your installed versions, identify affected environments, and prioritize deployment of the appropriate security updates. For older branches, verify vendor backports and make a plan to move to a supported release.
Do not rely solely on temporary configuration changes or the assumption that an application is safe because it uses a modern framework.
Official references
PHP security advisory — Critical remote code execution vulnerabilities, update now
https://www.php.net/archive/2026.php#2026-10-21-5Official PHP downloads
https://www.php.net/downloads.phpPHP supported versions
https://www.php.net/supported-versions.php
For technical decisions, use the official PHP advisory and your operating system vendor's security guidance as the authoritative references.