# PHP Vulnerability October 2026 > Two critical PHP flaws can allow code execution without a login. Learn which versions contain the fixes and what your hosting provider needs to confirm. Language: British English (en-GB). Canonical page: https://kbyte.co.uk/php-vulnerability-october-2026/ Last updated: 2026-10-22 The PHP vulnerability October 2026 alert concerns two critical flaws that can let an attacker execute code on a web server without signing in. PHP published the security release on 21 October. Website owners should ask whoever manages their hosting to confirm that the PHP runtime has received the fixes. ## Who needs to check their hosting PHP advises treating every installation that serves web requests as at risk. This includes PHP-FPM, Apache mod\_php, php-cgi, FrankenPHP and LiteSpeed. The highest demonstrated risk is with Apache mod\_php, where an unauthenticated request can trigger an attack before website code runs. Switching server configurations is not a substitute for patching. See the [official PHP security announcement](https://www.php.net/archive/2026.php#2026-10-21-5). ## The two PHP vulnerabilities explained **CVE-2026-109618** concerns memory corruption during out-of-memory handling. PHP can stop while preparing internal request data, then mistakenly use incomplete data during cleanup. The [PHP advisory for CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) explains the affected paths and technical details. **CVE-2026-109619** concerns internal state that remains accessible after its underlying memory has been released. A later request handled by the same worker can encounter that stale state. See the [PHP advisory for CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). ## Fixed PHP versions to ask your host about The security releases are listed on the [official PHP downloads page](https://www.php.net/downloads.php). For each supported branch, the fixes first appear in these versions. - PHP 8.2 — update to 8.2.35 or a later patched release. - PHP 8.3 — update to 8.3.36 or a later patched release. - PHP 8.4 — update to 8.4.27 or a later patched release. - PHP 8.5 — update to 8.5.12 or a later patched release. A Linux vendor may provide a package with backported fixes while retaining an older upstream version number. Ask for the vendor advisory and installed package revision. PHP 8.1 and older are outside normal upstream support, so confirm vendor coverage or plan an upgrade to a supported branch. PHP says temporary mitigations do not fully remove the risk. ## Why updating WordPress plugins is not enough WordPress, its themes and its plugins run on top of the server’s PHP runtime. Updating those website components does not install a PHP security update. Keep application updates in your maintenance plan, but ask your hosting provider or server administrator specifically about these two CVEs. With shared hosting, you may only control the selected PHP branch. On a virtual server, your administrator may manage packages and services directly. Agree who owns the update so that both parties do not assume the other has completed it. ## Check PHP versions on your Linux server Our [PHP vulnerability checker for Linux](https://github.com/KByteITServices/php-vulnerability-checker-october-2026) helps identify PHP versions that need an update or confirmation of vendor backports for both CVEs. It checks common Debian and Ubuntu runtime packages, standard host PHP binaries and CLI PHP in Docker or Podman containers accessible to your account. Open the repository, review its instructions and download check-php.sh. From the folder containing the script, run it on a server you administer with Bash 4 or later and the listed dependencies. bash check-php.sh The repository also provides a complete copy-and-paste version. The checker does not install updates, restart services or send exploit requests. - **VERSION\_OK** means the detected version meets the advisory’s upstream threshold. - **UPDATE\_OR\_VERIFY\_BACKPORT** means an update or vendor confirmation is needed. - **REVIEW** means the version needs manual assessment. - **NOT CHECKED** means that environment could not be inspected. This is a version inventory, not proof that a server is secure. Custom installations may be missed, and CLI PHP can differ from web PHP. Confirm vendor fixes and the runtime used by your web workers separately. ## A practical PHP vulnerability October 2026 checklist - List every affected website, including staging sites, subdomains and less frequently used applications. - Identify the PHP runtime serving each site. A command-line version check alone may describe a different installation from the one handling web traffic. - Ask the host to confirm the fixed package or upstream release for both CVEs. Record the response and the planned maintenance time. - Check backups and application compatibility before applying the update. Plan any necessary service restart so web workers actually use the patched runtime. - Verify the running web environment afterwards. Test representative pages and authorised application flows, then review error logs for regressions. Keep a short record of the websites checked, the package installed, the person responsible and the verification time. If several servers or containers serve the same website, include each instance. An updated control panel label alone is not evidence that every worker has restarted. ## Questions to send your hosting provider Ask whether your hosting is patched for CVE-2026-109618 and CVE-2026-109619, which package contains the fixes, and whether all relevant PHP workers have restarted. Also ask whether any sites remain on unsupported branches and what upgrade work they need. For help planning website maintenance, explore our [WordPress support services](https://kbyte.co.uk/wordpress-support-services/). Our [backup recovery checks guide](https://kbyte.co.uk/business-backup-recovery-checks/) explains how to assess recovery arrangements before changes. [Discuss your website and hosting setup](https://kbyte.co.uk/contact/) to agree the next steps. Consultancy is free; technical work is agreed separately. This article was checked against PHP’s official announcements on 22 October 2026. It explains what to verify and does not certify the patch status of any particular server.