PHP critical security advisory (Oct 21, 2026): what it means and how to check your server

Published 2026-10-22 · Last checked 2026-10-22 · security advisory

What happened

On Oct 21, 2026 the PHP project published a security advisory for two bugs, both rated CVSS v4.0 9.2:

• CVE-2026-109618, "RCE via OOM corruption." When PHP runs out of memory at the wrong moment, it can leave request data half set up, and cleanup then treats that broken data as valid.
• CVE-2026-109619, "RCE via stale global state." Some internal data from one request can survive after its memory is freed. A later request on the same worker can use it before it is reset.

Both can allow unauthenticated remote code execution. That means someone on the internet could run their own code on your server, with no password. The FBI Cyber Division also posted a warning about both CVEs on X.

PHP says the risk is highest for Apache with mod_php, where it has a working exploit that fires before any of your own code runs.

Steps

1. Check which PHP your website uses.

   On cPanel, open MultiPHP Manager and note the version for each domain. Your website can use a different PHP than the command line, so do not rely only on php -v.

2. Check the version number.

   You are on a fixed release if it is 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later in the same branch.

3. Do not panic about the build date.

   php -v may show something like PHP 8.4.27 (built: Oct 20 2026 ...). PHP gave Linux distributions and vendors the patches before the public release, so a build from the day before is normal.

4. Confirm the fix is in your build.

   Run this in a real server terminal (cPanel's Terminal or SSH, not phpMyAdmin, which only runs database queries). On cPanel servers, check the EasyApache package for your version (swap ea-php84 for ea-php83, ea-php82 and so on):

   rpm -qa | grep ea-php84 | xargs -n1 rpm -q --changelog | grep -i -E "CVE-2026-10961[89]"

   If you see both CVE-2026-109618 and CVE-2026-109619, you are patched. On other RPM-based servers, check your distro's PHP package changelog the same way. If you cannot run commands (shared hosting) or nothing shows up, ask your host whether their PHP build includes both fixes.

5. Update if you are behind.

   Use your distro or host packages, or build from source from php.net. If you use the volunteer-run rpms.remirepo.net repo, PHP says it will not have updates on release day and recommends switching to distro packages or building from source.

6. Restart PHP

   (PHP-FPM, Apache or LiteSpeed) after updating so every worker picks up the new version.

If you cannot update right away

PHP lists ways to reduce exposure. These are not a full fix, only an update is.

• For CVE-2026-109618: set memory_limit=-1 in a way apps cannot override (for example php_admin_value), and set a low post_max_size (8M if you do not need uploads, 32M if you do). Do not use RLIMIT_AS or RLIMIT_DATA as a memory cap.
• For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the server config (not ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0.

FAQ

Am I affected?

If PHP serves web requests on your server and it is older than the fixed versions, yes. That includes PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed.

My server says it was built on Oct 20. Is that unpatched?

Not necessarily. Vendors got the fixes before the Oct 21 public release. Check the changelog for both CVE ids, or ask your host.

php -v says I am patched. Am I done?

Check MultiPHP Manager (or your host panel) too. The website can run a different PHP version than the command line.

I am on PHP 8.1 or older. What now?

The PHP project no longer ships updates for 8.1 and older. Some distributions and LTS vendors have backported fixes, so ask them, or upgrade to a supported version. PHP also published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source.

Is PHP 8.2 still supported?

Yes, until Dec 31, 2026. After that it gets no security fixes, so plan an upgrade.

Are the workarounds enough?

No. PHP says updating is the only safe choice.

Sources

• PHP security advisory, Oct 21, 2026: https://www.php.net/archive/2026.php#2026-10-21-5
• PHP pre-announcement, Oct 20, 2026: https://www.php.net/archive/2026.php
• FBI Cyber Division on X: https://x.com/FBICyberDiv/status/2112921648252719420

All Coding pages →