PHP Security Update: Patch Critical RCE Bugs

PHP released critical fixes for two remote-code-execution flaws on 21 October 2026. Check affected versions, patch paths and a newly disclosed risk.

The PHP security update released on 21 October 2026 fixes two critical vulnerabilities that could allow attackers to execute code remotely on vulnerable web servers. The affected PHP releases include versions 8.2, 8.3, 8.4 and 8.5, with security updates available for each supported branch. On 23 October, PHP also disclosed another potential remote-code-execution issue involving an unusual configuration. If your website runs PHP, verify the installed version, apply the appropriate security update and review the latest configuration guidance before treating the server as protected.

Key Takeaways

• PHP released security updates on 21 October 2026, fixing CVE-2026-109618 and CVE-2026-109619, according to the official PHP security announcement.
• The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Both vulnerabilities received a CVSS 4.0 severity score of 9.2, and the European Union's CERT-EU advisory recommends immediate patching.
• PHP disclosed CVE-2026-115560 on 23 October 2026, affecting an unusual combination of session configuration and application behaviour.
• Temporary mitigations reduce exposure to specific attack paths but do not replace installing the appropriate security fixes.

Which PHP Versions Need the October 2026 Security Update

The first priority is identifying the PHP version that actually serves your application. The security releases published on 21 October address two critical vulnerabilities affecting multiple supported branches.

The PHP development team's release announcements identify the following fixed versions:

• PHP 8.5.12 fixes the two critical vulnerabilities affecting the PHP 8.5 branch.
• PHP 8.4.27 fixes the vulnerabilities affecting the PHP 8.4 branch.
• PHP 8.3.36 fixes the vulnerabilities affecting the PHP 8.3 branch.
• PHP 8.2.35 fixes the vulnerabilities affecting the PHP 8.2 branch.

Install the applicable fixed release or a security-patched package supplied by your operating-system or hosting provider. Distribution packages sometimes backport security fixes without changing the upstream version number in the same way as an official PHP release, so confirm the package's security status with the vendor.

The two issues have separate technical causes. CVE-2026-109618 concerns memory corruption during out-of-memory handling. CVE-2026-109619 concerns stale internal state that can survive after memory associated with an earlier request has been released.

PHP 8.1 and older branches no longer receive ordinary upstream security releases. Some distributions and long-term-support vendors provide backported fixes, and the PHP team published limited source backports for certain older branches. Administrators should verify the exact package and support arrangements rather than assuming an old installation is protected.

Why the PHP Remote Code Execution Vulnerabilities Matter

Remote code execution can allow an attacker to run commands on a vulnerable server. Depending on the server's permissions and the application's configuration, a successful compromise could expose files, application secrets, databases or other resources accessible to the affected process.

The first vulnerability involves PHP's handling of memory exhaustion. Under certain conditions, an out-of-memory error can interrupt request processing while internal data is only partially initialised. Subsequent cleanup may then operate on invalid memory.

The second vulnerability involves internal state that can remain accessible after its associated memory has been released. A later request handled by the same worker can encounter that stale state before normal initialisation resets it.

These are vulnerabilities in PHP itself, not simply mistakes in an application's business logic. Updating application code alone does not necessarily resolve them.

The UK National Cyber Security Centre's advisory says organisations should identify PHP installations throughout their infrastructure, prioritise internet-facing systems and install the latest fixed versions.

The incident also demonstrates the importance of coordinated vulnerability disclosure. In its 21 October security announcement, OpenAI described how its researchers, Calif, Wiz, PHP maintainers and other partners contributed to discovering, investigating or addressing the vulnerabilities. PHP maintainers led the fixes and their release.

The immediate priority for website owners is not to determine which researcher discovered a particular issue. It is to establish exposure, deploy the appropriate fix and confirm that the running service uses the protected build.

Who Is Affected by the PHP Security Update

Any organisation running PHP to serve web requests should investigate its exposure, including websites hosted on managed platforms and applications deployed through containers.

The affected environments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. CERT-EU identifies Apache mod_php as the highest-risk setup for the two critical vulnerabilities because a demonstrated attack can trigger the vulnerable path before application code executes.

In the United States, a company operating a PHP application on a virtual machine or container platform should inventory every production instance and confirm which image or package supplies PHP. A patched development laptop does not protect an older production container.

In the United Kingdom, organisations should follow the NCSC's guidance to prioritise internet-facing systems and assess potentially compromised installations before or during remediation. The agency advises taking a system offline when immediate updating or mitigation is not feasible.

In India, website operators should apply the same technical checks regardless of whether their servers are hosted locally or through an international cloud provider. A managed hosting account may require a provider-side runtime change rather than an application deployment.

The third vulnerability requires separate attention. PHP's official 23 October informational advisory identifies CVE-2026-115560, which affects an unusual configuration involving changes to the session serialization handler before a session starts while session upload progress remains enabled.

PHP considers this scenario unlikely in ordinary applications and plans to provide a full advisory with a subsequent regular release. The recommended interim mitigation is to disable session upload progress and restart the affected workers.

Do not assume that installing the 21 October releases alone addresses every issue disclosed afterward. Review the latest official advisory for each vulnerability and verify the configuration requirements that apply to your application.

Six Steps to Patch PHP Safely in Production

A safe response begins with an inventory and ends with verification. Updating one server is insufficient if other environments continue running vulnerable builds.

1. Inventory every PHP runtime. Check production servers, staging environments, containers, scheduled jobs and managed hosting accounts. Run php -v in the relevant environment, but also confirm the version used by the actual web service because the command-line runtime may differ from PHP-FPM or the Apache module.

2. Map each installation to its fixed release. Identify the current branch and compare it with the fixed versions listed in the official PHP advisory. If you use a distribution package, confirm whether the vendor has backported the fix and follow its package-specific instructions.

3. Prioritise internet-facing services. Update public websites and exposed application endpoints first, followed by internal systems. Coordinate the deployment with your normal change process so that the relevant workers, containers and services restart onto the patched build.

4. Apply the separate session mitigation where necessary. Review the 23 October advisory for CVE-2026-115560. If the unusual configuration applies, disable session upload progress through an appropriate server-level setting and restart every affected worker until the next regular bugfix release provides the relevant fix.

5. Verify the deployment and configuration. Confirm the running PHP version, package status and service health. The free hash generator can calculate a downloaded file's digest for comparison with an official checksum, although a matching hash alone does not establish the authenticity of an unsigned source.

6. Review application behaviour and document the result. Run relevant tests for uploads, sessions, authentication and database operations. Compare configuration snapshots with the text diff checker to identify unintended changes. Record the affected assets, installed package versions, mitigation status and any remaining risks.

These steps should follow the package vendor's instructions. Avoid copying emergency configuration changes blindly between different PHP versions or deployment architectures.

Common PHP Security Update Mistakes to Avoid

A hurried patch can leave important systems exposed if the deployment process does not account for the complete runtime.

• Updating only the command-line version. Verify the PHP runtime used by the actual web server and restart the relevant workers.
• Assuming the framework is the source of the vulnerability. The two critical issues affect PHP internals, so application-level changes alone are not the complete fix.
• Treating temporary mitigation as permanent protection. PHP explicitly states that only updating fully fixes the two critical vulnerabilities.
• Ignoring older branches. PHP 8.1 and earlier require careful review of vendor support and available backports.
• Overlooking the third vulnerability. Check the 23 October advisory and determine whether the unusual session configuration applies to your application.

Our Take

The PHP security update deserves immediate attention because the two critical vulnerabilities affect the runtime beneath many websites and applications. A disciplined inventory, supported package update and post-deployment verification are more reliable than applying a configuration workaround and assuming the problem is solved. The separate 23 October disclosure also shows why security monitoring must continue after an emergency patch is installed.

What to Watch After the October PHP Security Release

PHP plans to publish a full advisory for CVE-2026-115560 with a subsequent regular release. Until then, administrators should follow the official recommendation to disable session upload progress where required by the advisory.

PHP 8.2 is also approaching its upstream end-of-life date of 31 December 2026, making this a useful time to review longer-term upgrade plans. Organisations relying on older PHP branches should confirm their vendor's security-support commitments and document any temporary backports.

Continue monitoring the PHP security archive and relevant hosting-provider notices. Recheck the deployed version after container rebuilds, platform updates or scaling events so that a previously patched service is not replaced by an outdated image.

Frequently Asked Questions

Which PHP versions fix the October 2026 critical vulnerabilities?

The official fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address CVE-2026-109618 and CVE-2026-109619. Organisations using distribution packages should verify whether their vendor has supplied equivalent security backports before deciding that an older upstream version remains vulnerable.

Can attackers exploit the PHP vulnerabilities without logging in?

Yes. Both disclosed vulnerabilities can permit unauthenticated remote code execution under applicable conditions. CERT-EU identifies several affected PHP deployment types and notes that a demonstrated attack can trigger vulnerable behaviour before application code executes in Apache mod_php. Internet-facing installations should therefore receive priority during remediation.

Is updating PHP enough to address CVE-2026-115560?

The 21 October releases address the two earlier critical vulnerabilities, while CVE-2026-115560 was disclosed on 23 October. PHP recommends disabling session upload progress for the unusual configuration affected by the newer issue until the next regular bugfix release. Check the latest official advisory before declaring the system fully protected.

What should I do if my hosting provider cannot update PHP immediately?

Ask the provider to confirm the affected runtime, available vendor backports and approved temporary mitigations. Follow the official PHP and CERT-EU guidance rather than applying unrelated configuration changes. If the system cannot be adequately mitigated, consider isolating it from public access until a verified fix is available.

How can I check whether my website is running a fixed PHP version?

Check the runtime version and package information for the environment serving web requests, not just your local command-line installation. Compare the result with the official fixed releases and confirm any vendor backport. Restart relevant services after deployment and verify the version again to ensure the patched runtime is active.