The PHP vulnerability October 2026 alert concerns two critical flaws that can let an attacker execute code on a web server without signing in. PHP published the security release on 21 October. Website owners should ask whoever manages their hosting to confirm that the PHP runtime has received the fixes.
Who needs to check their hosting
PHP advises treating every installation that serves web requests as at risk. This includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The highest demonstrated risk is with Apache mod_php, where an unauthenticated request can trigger an attack before website code runs. Switching server configurations is not a substitute for patching. See the official PHP security announcement.
The two PHP vulnerabilities explained
CVE-2026-109618 concerns memory corruption during out-of-memory handling. PHP can stop while preparing internal request data, then mistakenly use incomplete data during cleanup. The PHP advisory for CVE-2026-109618 explains the affected paths and technical details.
CVE-2026-109619 concerns internal state that remains accessible after its underlying memory has been released. A later request handled by the same worker can encounter that stale state. See the PHP advisory for CVE-2026-109619.
Fixed PHP versions to ask your host about
The security releases are listed on the official PHP downloads page. For each supported branch, the fixes first appear in these versions.
- PHP 8.2 — update to 8.2.35 or a later patched release.
- PHP 8.3 — update to 8.3.36 or a later patched release.
- PHP 8.4 — update to 8.4.27 or a later patched release.
- PHP 8.5 — update to 8.5.12 or a later patched release.
A Linux vendor may provide a package with backported fixes while retaining an older upstream version number. Ask for the vendor advisory and installed package revision. PHP 8.1 and older are outside normal upstream support, so confirm vendor coverage or plan an upgrade to a supported branch. PHP says temporary mitigations do not fully remove the risk.
Why updating WordPress plugins is not enough
WordPress, its themes and its plugins run on top of the server’s PHP runtime. Updating those website components does not install a PHP security update. Keep application updates in your maintenance plan, but ask your hosting provider or server administrator specifically about these two CVEs.
With shared hosting, you may only control the selected PHP branch. On a virtual server, your administrator may manage packages and services directly. Agree who owns the update so that both parties do not assume the other has completed it.
A practical PHP vulnerability October 2026 checklist
- List every affected website, including staging sites, subdomains and less frequently used applications.
- Identify the PHP runtime serving each site. A command-line version check alone may describe a different installation from the one handling web traffic.
- Ask the host to confirm the fixed package or upstream release for both CVEs. Record the response and the planned maintenance time.
- Check backups and application compatibility before applying the update. Plan any necessary service restart so web workers actually use the patched runtime.
- Verify the running web environment afterwards. Test representative pages and authorised application flows, then review error logs for regressions.
Keep a short record of the websites checked, the package installed, the person responsible and the verification time. If several servers or containers serve the same website, include each instance. An updated control panel label alone is not evidence that every worker has restarted.
Questions to send your hosting provider
Ask whether your hosting is patched for CVE-2026-109618 and CVE-2026-109619, which package contains the fixes, and whether all relevant PHP workers have restarted. Also ask whether any sites remain on unsupported branches and what upgrade work they need.
For help planning website maintenance, explore our WordPress support services. Our backup recovery checks guide explains how to assess recovery arrangements before changes. Discuss your website and hosting setup to agree the next steps. Consultancy is free; technical work is agreed separately.
This article was checked against PHP’s official announcements on 22 October 2026. It explains what to verify and does not certify the patch status of any particular server.