Critical PHP Vulnerabilities Push Emergency Updates for 8.5.12, 8.4.27, 8.3.36 and 8.2.35

Updating PHP is the clearest way to protect a business website from two newly patched vulnerabilities that can allow unauthenticated remote code execution. PHP released fixed versions on October 21, 2026, and PHP says updating is the only complete solution.

The PHP Foundation’s security advisory lists CVE-2026-109618, an out-of-memory corruption issue, and CVE-2026-109619, a stale global-state issue. Both have a CVSS v4.0 score of 9.2. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What happened

PHP published emergency security releases on October 21, 2026, for two critical flaws in the PHP engine. According to the PHP Foundation, both vulnerabilities can allow unauthenticated remote code execution, so every web-facing PHP installation needs attention.

The issue sits below WordPress, Magento, Drupal, Joomla, MediaWiki, Laravel and other applications built on PHP. Cloudflare reported early attacks before the official release, according to WIRED. Sansec said it expected mass attacks to begin within 15 minutes of the release, which happened just before 10 a.m. Eastern Time, according to WIRED.

Update, October 22, 2026

CloudLinux reports that three Imunify360 ruleset releases on October 21, 2026, carry rules for these CVEs. According to CloudLinux, Imunify360 servers with the WAF enabled receive the updates automatically. CloudLinux reports that the releases are rulesets 8.83, 8.84 and 8.85, with the latest rules intended to block further variants of the public exploit tool and log unusual upload requests.

CloudLinux says the Imunify360 rules act as a virtual patch because they stop known request patterns at the server edge while vulnerable PHP code remains in place. CloudLinux says that on ModSecurity with Apache or Nginx, and on Coraza, the rules can block known exploit requests and the public exploit tool. CloudLinux says this is an interim mitigation, not a fix, and that only the PHP update closes the flaws.

CloudLinux says the WAF-enabled setup receives it automatically, but the PHP update remains necessary. CloudLinux also reports fixed ea-php packages for cPanel EasyApache 4, from ea-php52 through ea-php85. PHP 8.1 and older receive no release from the PHP project, although minimal source backports exist for PHP 7.4, 8.0 and 8.1, according to CloudLinux.

Are you affected?

PHP installations that serve web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where a demonstrated exploit can run before application code starts. The WIRED report on the flaws also describes websites using PHP for publishing, stores and other web applications.

Check the PHP version serving each public website. Treat PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as patched versions for these CVEs. Older releases remain affected unless the distribution or long-term-support vendor has supplied a fixed package. PHP 8.1 and older no longer receive updates from the PHP project, so ask the vendor about a backport or plan an upgrade to a supported version.

Do not check only WordPress. The vulnerabilities are in PHP itself. The PHP Foundation says the update must be applied at the server or hosting-package level. PHP 8.2 reaches end of life on December 31, 2026, according to its release notes.

What to do now

1. List every internet-facing website and service that uses PHP, including stores, content sites, customer portals and bundled appliances. The UK NCSC recommends identifying PHP installations generally rather than checking only outdated versions.

2. Ask the host or server administrator to confirm that every serving PHP installation is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or on the vendor’s equivalent patched package. Servers can run several PHP versions, so check each one.

3. If the WAF is enabled, CloudLinux says the rulesets arrive automatically. Do not treat the firewall rules as a substitute for updating PHP.

4. If the server update must wait, apply the PHP Foundation’s temporary measures. Its advisory includes setting session.upload_progress.enabled=0, restarting workers, setting memory_limit=-1, lowering post_max_size, and applying request limits at the web-server or proxy level. PHP says these measures reduce exposure to specific attack paths but do not make the installation safe.

5. If an immediate update and the temporary measures will take too long, consider taking the affected system offline until it can be fully mitigated, as the UK NCSC recommends.

What we’re seeing

Why this matters for online visibility

Wiz Research says the flaws could allow attackers to take control of affected servers, steal sensitive data and deface websites. Sensitive process memory may contain passwords, authentication tokens, API keys and certificates, according to Wiz Research.

Wiz Research reports that PHP powers 70% of websites and that every PHP version released in the last decade is affected by at least one of the vulnerabilities, going back to version 5.4.

FAQ

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

PHP lists versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. PHP 8.1 and older receive no project release, although minimal source backports were published for PHP 7.4, 8.0 and 8.1.

Do I need to update WordPress to fix these PHP vulnerabilities?

No. The vulnerabilities are in the PHP engine, so the fix belongs at the server or hosting-package level. Update PHP or install the vendor’s patched PHP package.

What should I do if my web host runs Imunify360?

CloudLinux says enabled Imunify360 WAF hosts receive the rules automatically. The firewall rules are an interim mitigation, and PHP says updating PHP is the only complete fix.

See our editorial disclaimer for how our articles are produced.