Security releases are available
PHP published fixes on 21 October 2026 for two critical vulnerabilities that can permit unauthenticated remote code execution. Its security team urges users running PHP to serve web requests to update immediately.
The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address CVE-2026-109618 and CVE-2026-109619. The issues involve memory handling and state retained between requests; the exact exposure depends on the server setup.
What to ask your hosting provider
If a host manages PHP for your website, ask whether its running PHP service has received fixes for both CVEs. Distribution and long-term support vendors may supply patched packages, so confirm their security notice rather than relying only on an upstream version number. Ask the host to confirm that any required service restarts are complete, too.
For a server you manage, follow the official PHP advisory and your package vendor’s update instructions. Updating website themes or plugins alone does not establish that the PHP runtime has been patched.
Older branches need attention
PHP 8.1 and older no longer receive regular fixes from the PHP project. Ask your vendor about maintained backports or move to a supported branch. PHP 8.2 remains security-supported until 31 December 2026.
PHP says an update is the only complete solution. Temporary configuration changes do not make an affected installation safe. The advisories describe vulnerability risk, not evidence that every affected website has been breached.
