Sarıtaş 21 October 2026 PHP Security Alert: What Happened and How to Respond
Two critical remote code execution vulnerabilities, affected PHP versions, and the update steps website owners should take.
On 21 October 2026, the PHP team released security updates for two critical vulnerabilities that can allow remote code execution without authentication. The issue concerns the PHP runtime on the server, rather than one specific plugin or website. Official PHP announcement.
What are the two vulnerabilities?
CVE-2026-109618 involves inconsistent request data after an out-of-memory condition. Request cleanup may turn this state into code execution. A demonstrated Apache mod_php attack path can trigger before application code starts. Technical advisory.
CVE-2026-109619 involves worker state that still points to memory owned by an earlier request. A later request may access this stale state. Technical advisory.
Which versions contain the fixes?
The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Install the fixed release for your branch or a later patched version. If your vendor provides backported patches, ask for confirmation. Restart all PHP workers after updating and verify the version actually serving web requests.
What should website owners do today?
- Back up files and databases, and check the recovery process.
- Ask your hosting provider to confirm the active PHP version and security patch.
- After updating, test login, contact forms and uploads.
- Review logs and unexpected file changes. Rotate credentials if there is evidence of compromise.
An advisory is not evidence of a breach
This article describes confirmed vulnerabilities. Claiming that every PHP website was attacked, or that this website leaked data, would require incident evidence. Upload validation and request limits provide additional protection; they do not replace the PHP patch.