Critical security updates were released for PHP on 21st October 2026. These address 2 critical vulnerabilities that could allow an attacker to run malicious code on vulnerable web servers. I would recommend checking your current version of PHP, applying any relevant patches and checking your server configurations to mitigate against these issues.
PHP is used by many websites, WordPress and business applications. If there are vulnerabilities within the runtime itself then this could affect your application even if your source code has been written with best practices. If you have any PHP based applications within your business then professional web development and maintenance can help you keep your applications up to date with secure updates.
PHP released patches for CVE-2026-109618 and CVE-2026-109619 on 21st October 2026. Developers should upgrade to either PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Check your server configurations and look into any suspicious activity. It is vital to upgrade your software as workarounds will not fully resolve these issues.
What Are the Latest Critical PHP Security Updates in 2026?
This blog aims to provide a summary of new emergency security updates released by the PHP development team on the 21st of October 2026.
Both issues have been given a CVSS v4.0 score of 9.2 out of 10.
Why Is This Important?
- Potential unauthorised remote code execution
- Application vulnerable data could be exposed
- Can be exploited even before application code runs
- Affects multiple PHP web server configurations
- By installing the patched versions of these there will be less risk
These updates should be high priority maintenance instead of general improvements.
The October 2026 PHP security updates have fixed critical run-time issues that need to be patched quickly.
Which PHP Vulnerabilities Were Discovered?
There are 2 vulnerabilities in PHP that have been discovered, these are referred to as PHP2Shell.
CVE-2026-109618 – Out Of Memory Corruption
This vulnerability occurs due to incorrect handling of internal request data when there isn’t enough memory allocated.
An attacker could exploit this by causing memory corruption under certain circumstances to execute unauthorised code.
CVE-2026-109619 – Stale Global State
This vulnerability occurs as internal request data exists even after the memory that was allocated has been freed.
This means that the next request could interact with this data which creates an opportunity for exploitation.
What is Remote Code Execution?
Remote Code Execution (RCE) allows the attacker to execute unauthorised instructions on a vulnerable system.
If the attacker is successful they could cause damage to files, expose sensitive information or cause disruption to the website.
Both of the vulnerabilities in PHP are caused by memory management issues and can cause Remote Code Execution.
Which PHP Versions Are Affected and Need Updating?
Developers running vulnerable PHP releases should move to an appropriate patched version.
PHP Security Patch Versions
|
PHP Branch |
Minimum Patched Version |
|
PHP 8.2 |
8.2.35 |
|
PHP 8.3 |
8.3.36 |
|
PHP 8.4 |
8.4.27 |
|
PHP 8.5 |
8.5.12 |
The following versions are affected by these critical security issues.
PHP 8.1 and earlier are now out of active security release support from the PHP project. Whilst some OS vendors will provide backported fixes there should be a plan in place to move to an actively supported version.
PHP 8.2 has an end of security support date of December 31st 2026.
Upgrade your installation to a patched version to ensure the applications remain secure.
How Can Developers Check Their PHP Security Status?
It is recommended to identify what versions of PHP you are using on your servers.
How To Identify PHP Version
- Login to your hosting dashboard or server.
- Identify what version of PHP you have installed.
- Identify what version of PHP is being used to process requests on your website.
- Compare this against the patched versions.
- Check for any security notices from your hosting provider.
Run the following command:
php -v
This will tell you what version of PHP you have installed via the CLI. This may not match the version used by the web server.
If you are using WordPress then you can view the PHP version by going to Tools → Site Health → Info → Server.
How Do You Apply PHP Security Updates Safely?
You should consider your application requirements before upgrading PHP. This could be due to dependencies on certain extensions, libraries or frameworks.
Recommended Upgrade Steps
- Backup your application files, databases and configs.
- Check if your framework, plugins and extensions are compatible.
- Upgrade to a supported secure version of PHP.
- Restart any PHP workers and web services affected.
- Test authentication, forms, payment and API.
- Check the PHP version is running.
- Check your application logs for any unexpected errors.
Where possible these changes should be tested within a staging environment. However, if there are security updates that need to happen in a hurry then you should not wait.
Whilst temporary changes can be made to your config to help reduce risk of certain attack vectors, this does not substitute for upgrading to patched versions.
Upgrading PHP securely will involve backing up, checking for compatibility, upgrading to a patched version and verifying.
What PHP Security Best Practices Should Developers Follow?
Keeping your applications up-to-date is an absolute must. In addition, you should also ensure that your application has a secure architecture.
Essential PHP Security Best Practice
- Ensure all data entered is validated.
- Use prepared statements to protect against SQL injection attacks on your database.
- Strong authentication and access controls.
- Secure cookies and sessions.
- Keep your frameworks and libraries updated.
- Avoid showing any sensitive debug information.
- Monitor logs and look out for any strange activity on your application.
For more information I would highly recommend looking at the OWASP Top 10 and official PHP security resources.
Your best practices for PHP should cover many areas of vulnerabilities such as runtime, application code, dependencies and server.
How Can You Detect Potential PHP Server Compromise?
Patching will prevent known vulnerable paths but does not guarantee the system wasn’t already compromised.
Signs of compromise
- PHP workers crashing unexpectedly (segmentation faults).
- New unknown files in application folders.
- Unusual network connections.
- Suspicious activity on admin accounts.
- Unexpected changes to the server configuration.
- Unusual requests in the access log.
The CERT-In security advisory shows that there are some serious risks involved with these vulnerabilities.
Logs should be kept and any suspicious activity investigated. An incident response process should be followed.
Patching and investigating an incident are two different tasks which can both be required.
Why Are Continuous PHP Security Solutions Important?
When using PHP, you always need to ensure that it is secure.
Keeping your PHP secure
- Keep track of your PHP deployments and ensure they are up-to-date.
- Keep up-to-date with any official reports around vulnerabilities.
- Plan updates for your dependencies and runtime.
- Perform regular vulnerability checks.
- Ensure your backups and recovery process are set up.
- Monitor logs from your application and infrastructure.
Many businesses will also employ a professional PHP security service to perform vulnerability scans, secure configuration checks, penetration testing and ongoing monitoring.
This helps organisations identify vulnerabilities and threats, as well as keeping their applications secure.
Conclusion
The October 2026 PHP security updates highlight the importance of keeping your runtimes secure.
Check that you are running any of the affected versions and ensure that the security updates are applied. Review your dependencies and look out for any unusual activity.
If you would like more security options for your business, Fenizo Technologies offer a range of Cyber Security services including vulnerability scanning, application security and infrastructure security.
Keeping your software up-to-date and implementing security measures will help to reduce any unnecessary risks and will make your applications more reliable.