Critical PHP vulnerabilities: how to patch CVE-2026-109618 and CVE-2026-109619

Update — 25 October 2026. The PHP project has disclosed two critical remote-code-execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The PHP project says unauthenticated requests may trigger these issues in web-facing installations.

Fixed versions

Upgrade to at least the fixed release for the branch you run: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Check the official PHP security advisories for newer releases and current support status before scheduling the change.

Patch checklist

1. Inventory every PHP runtime that serves requests: PHP-FPM pools, Apache mod_php, CGI/FastCGI, containers, workers and staging instances. php -v checks the command-line binary only; it may not be the same PHP build used by the website.
2. Upgrade through your operating-system packages, hosting control panel or container base image to a fixed release on a supported branch. Rebuild and redeploy pinned images where needed.
3. Restart or roll out PHP-FPM, Apache/LiteSpeed, queue workers and long-running application processes so they load the patched runtime.
4. Verify the version in the web-serving runtime and monitor application and service logs after deployment. Keep a rollback plan that does not restore a vulnerable image.

Temporary mitigation

If an immediate update is not possible, PHP's 23 October informational advisory recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release as a mitigation for an unlikely RCE vector associated with CVE-2026-109619. Apply it in the effective configuration for the affected web SAPI and restart the relevant service. This is temporary risk reduction, not a substitute for installing the patched release.

The PHP project rates these flaws critical and urges immediate updates. Treat every internet-facing PHP runtime as in scope until you have confirmed its branch and patch status.