Critical PHP Vulnerabilities Allow Remote Code Execution: Urgent Security Updates Released

On 21 October 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities could potentially allow attackers to execute arbitrary code on vulnerable web servers without authentication.

The security flaws affect PHP itself rather than individual websites or content management systems. This makes the issue particularly important for hosting providers and administrators running WordPress, Joomla, Drupal, MODX and other PHP-based applications.

What Are the Critical PHP Vulnerabilities?

The first vulnerability, CVE-2026-109618, involves memory corruption during out-of-memory (OOM) conditions. When PHP runs out of available memory while processing internal request data, certain structures may remain partially initialized. Subsequent cleanup operations can incorrectly handle this data, potentially creating an opportunity for remote code execution.

The second vulnerability, CVE-2026-109619, is related to stale global state. Under certain conditions, internal PHP structures may retain references to memory that has already been released. This can lead to unsafe memory access and potentially allow attackers to execute malicious code.

According to the PHP development team, the vulnerabilities affect multiple server configurations, including PHP-FPM, Apache with mod_php, PHP-CGI, FrankenPHP and LiteSpeed. The risk is considered especially serious for Apache mod_php, where researchers demonstrated an attack that could be triggered by an unauthenticated request before application code begins executing.

Which PHP Versions Need Updating?

The PHP development team released the following security updates on 21 October 2026:

Older PHP branches, including PHP 8.1, 8.0, 7.4 and 5.6, no longer receive regular security updates from the PHP development team. Servers still running these versions require particular attention. Depending on the operating system and package provider, security fixes may be available as backported patches, even when the displayed PHP version remains unchanged.

Administrators should therefore verify not only the PHP version number but also whether the installed package includes the relevant security fixes.

Why Are These Vulnerabilities Particularly Dangerous for Web Hosting?

Unlike vulnerabilities affecting individual plugins, themes or content management systems, security flaws in PHP can potentially compromise the underlying execution environment used by many websites.

A fully updated WordPress, Joomla or MODX installation does not automatically protect against vulnerabilities in the PHP interpreter. Even websites following established security practices may remain exposed when their hosting environment uses vulnerable software.

If successfully exploited, remote code execution could allow attackers to run malicious operations with the permissions of the affected PHP process. Depending on server configuration, this may expose website files, configuration data, database credentials and other sensitive information accessible to that process.

The situation becomes more complicated on shared hosting servers where multiple PHP versions are installed simultaneously. Updating PHP 8.4, for example, does not protect websites that continue running a vulnerable PHP 8.1 or PHP 7.4 environment.

What Should Website Owners and Server Administrators Do?

The PHP development team has emphasized that there are no complete mitigations for these vulnerabilities. Installing the appropriate security updates is the only reliable solution.

Website owners and hosting administrators should take the following steps:

• Identify the PHP versions currently used by all hosted websites and applications.
• Install the latest security updates for supported PHP branches.
• Verify that the installed PHP packages contain fixes for CVE-2026-109618 and CVE-2026-109619.
• Check websites running outdated PHP versions and assess available security patches or migration options.
• Restart the affected PHP services when required and confirm that the updated versions are active.
• Review server configurations and ensure that PHP processes operate with appropriately restricted permissions.

For legacy applications that cannot immediately migrate to a supported PHP version, security-maintained distribution packages containing backported fixes may provide a temporary solution. However, such configurations require careful verification and ongoing maintenance.

Website Security Starts with the Hosting Infrastructure

The discovery of these critical PHP vulnerabilities demonstrates that website security depends on much more than updating a CMS, plugins or themes. The operating system, PHP interpreter, web server and supporting software must also receive timely security maintenance.

At FairyHosting, we understand the importance of maintaining a secure and reliable hosting environment, particularly for websites and applications that depend on different PHP versions.

If you are unsure whether your website is running a secure PHP version, the FairyHosting team can help you review your hosting environment, assess compatibility with updated PHP versions and identify appropriate solutions for improving website security.

Official source: PHP Development Team — Critical Remote Code Execution Vulnerabilities, 21 October 2026.