PHP critical RCE (CVE-2026-109618, CVE-2026-109619): how to check your site and update
On 21 October 2026 the PHP project released security updates for two critical vulnerabilities that can let an unauthenticated attacker run code on your server. PHP runs WordPress and a large share of business websites. If your site or internal system runs on PHP, check your version and update now.
In this post:
- What was fixed (from the official advisory)
- The fixed version numbers
- How to check which PHP version your site runs
- What to do if you can't update right away
What was fixed
According to the official PHP advisory, the two issues are:
- CVE-2026-109618 — when out-of-memory handling interrupts PHP while request data is only partly set up, request cleanup can treat that invalid data as valid.
- CVE-2026-109619 — internal state owned by one request can survive after its memory is freed, and a later request on the same worker can use it.
Both are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution.
The advisory says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit runs before any application code.
Fixed versions
Update to at least:
- PHP 8.5: 8.5.12
- PHP 8.4: 8.4.27
- PHP 8.3: 8.3.36
- PHP 8.2: 8.2.35 (8.2 reaches end of life on 31 December 2026)
PHP 8.1 and older no longer get official releases. The security team published minimal backports for 7.4, 8.0 and 8.1 on GitHub, but moving to a supported version is the safer plan.
Check which PHP version you run
WordPress
In the dashboard, go to Tools → Site Health → Info → Server. The PHP version is listed there.
Shared hosting
Most hosting control panels have a "PHP version" page where you can see and switch the version. On shared hosting, your provider may be rolling out the fix for you — check your host's status or news page. Some hosts are doing emergency maintenance, so your site or panel may be briefly unavailable.
Your own server
Run php -v. The command-line PHP and the PHP your web server uses can differ, so check the web one too (for example, the PHP-FPM package version).
If you create a phpinfo() page to check, delete it straight away — it exposes details about your server.
An agency or developer runs your site
Ask them directly: "Have you updated PHP for CVE-2026-109618 and CVE-2026-109619, and which version are we on now?"
If you can't update right away
The advisory is clear: only updating is a complete fix.
It lists settings that reduce exposure to specific attack paths — for example setting session.upload_progress.enabled=0 in php.ini or the FPM pool and restarting every worker — but says these do not make an installation safe. Treat them as a stopgap and update as soon as you can.
Checklist
- ☐ Confirmed whether your site or system runs on PHP
- ☐ Checked the PHP version
- ☐ Updated to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later (or scheduled it)
- ☐ On shared hosting: read your host's notice
- ☐ Using an agency: asked them for their status
- ☐ Deleted any
phpinfo()page you created
Sources
- PHP security advisory, 21 October 2026: https://www.php.net/archive/2026.php#2026-10-21-5
- PHP 8.5.12 release: https://www.php.net/archive/2026.php#2026-10-21-4
- PHP 8.4.27 release: https://www.php.net/archive/2026.php#2026-10-21-3
- PHP 8.3.36 release: https://www.php.net/archive/2026.php#2026-10-21-2
- PHP 8.2.35 release: https://www.php.net/archive/2026.php#2026-10-21-1
Written with the help of AI from the official PHP announcements as of 21 October 2026. The situation may change; check php.net and your hosting provider for the latest.