Two Critical PHP Vulnerabilities: What to Update and How.
On Oct 20, 2026, the PHP security team announced a security release that fixes two critical vulnerabilities, both rated 9.2 out of 10 under CVSS v4.0. The fixed releases, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, came out on Oct 21, 2026. The PHP project says there is no complete workaround, so updating is the only safe choice. If your website or application runs on PHP, check which version it runs and update to the fixed release.
Facts on this page come from the PHP project and the sources listed below, last checked Oct 27, 2026.
What PHP Version Do You Run?
Pick your PHP version. We will tell you whether you need the fixed release, how to update, or what to do if your version is past end of life. Nothing you enter is stored or sent to us.
How Serious Is This?
CVSS is the standard scale security teams use to rate vulnerabilities from 0 to 10. Both of these sit in its top band, Critical.
PHP RCE via Out-of-Memory Corruption
9.2out of 10Critical
CVSS v4.0 rates 9.0 to 10.0 as Critical, the highest of its four bands. - Where it is
- PHP core: out-of-memory handling while a request starts up and shuts down. Oversized multipart form uploads are one way to trigger it.
- What it is
- When PHP runs out of memory at the wrong moment, it can leave internal request data half set up. The cleanup at the end of the request then treats that broken data as valid.
- What an attacker could do
- Unauthenticated remote code execution as the web server's PHP user. The advisory confirms a working exploit against Apache mod_php with default memory limits, before any application code runs. No complete PHP-FPM exploit has been shown, but its source analysis says FPM is susceptible. The PHP Foundation's release post adds that remote code execution was also confirmed on PHP-FPM through application code paths.
- Known attacks
- Yes. On October 26, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, which means it has evidence attackers are using it. US federal agencies must fix it by October 29. A researcher's decoy servers on PHP 8.4.26 with Apache mod_php recorded attackers starting command shells on October 24. Update PHP now, then check your servers for signs of attack going back to at least October 17.
- CVSS v4.0 vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Official advisory
- GHSA-w8hw-w9fx-j79w
PHP RCE via Stale Global State
9.2out of 10Critical
CVSS v4.0 rates 9.0 to 10.0 as Critical, the highest of its four bands. - Where it is
- PHP core: error, session, object and extension state that a PHP worker keeps between requests, including session upload progress (on by default).
- What it is
- Some internal state belonging to one request can survive after its memory is freed. The next request handled by the same worker can use that stale state before PHP resets it.
- What an attacker could do
- Unauthenticated use-after-free, memory disclosure and remote code execution with the web worker's privileges. The advisory confirms remote code execution against Apache mod_php, and through session upload progress against PHP-FPM too.
- Known attacks
- Yes. On October 26, 2026, CISA added this flaw to its Known Exploited Vulnerabilities catalog, which means it has evidence attackers are using it. US federal agencies must fix it by October 29. A researcher's decoy servers on PHP 8.4.26 with Apache mod_php recorded attackers starting command shells on October 24. Update PHP now, then check your servers for signs of attack going back to at least October 17.
- CVSS v4.0 vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N- Official advisory
- GHSA-6wmf-4rv5-p3rp
| CVSS measure | Rating | In plain terms |
|---|---|---|
| Attack vector | Network | Can be attacked over the internet. |
| Attack complexity | High | The attacker has to work around conditions such as memory layout. |
| Attack requirements | Present | Depends on how PHP is set up, for example which server module runs it. |
| Privileges required | None | No login or account needed. |
| User interaction | None | Nobody has to click anything. |
| Confidentiality, integrity, availability | High | An attacker could read data, change it, and take the site down. |
Critical is the highest of the four CVSS bands. The vector string on each card shows how the score was reached, and the CVSS v4.0 specification explains each part.
Who Is Affected
Any website, web application, or script running a PHP version older than the fixed release for its branch.
That includes sites where a hosting company, a control panel, or a Linux distribution installs PHP for you. They still have to ship the update, and someone has to confirm it reached your server.
The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit works with one unauthenticated request before any application code runs. Laravel, WordPress, Drupal, and other PHP applications are exposed through the PHP they run on, even when their own code is fine.
End-of-life versions (PHP 8.1 and older) are affected too, and the PHP project will not release fixed versions for them. Some Linux distributions and long-term support vendors ship backported fixes, so check with yours. Otherwise the safe path is moving to a supported version.
Affected and Fixed Versions
| PHP version | Support | Latest release before the fix | Affected | Update to |
|---|---|---|---|---|
| PHP 8.5 | Security fixes until Dec 31, 2029 | 8.5.11 | Yes | 8.5.12 |
| PHP 8.4 | Security fixes until Dec 31, 2028 | 8.4.26 | Yes | 8.4.27 |
| PHP 8.3 | Security fixes until Dec 31, 2027 | 8.3.35 | Yes | 8.3.36 |
| PHP 8.2 | Security fixes until Dec 31, 2026 | 8.2.34 | Yes | 8.2.35 |
| PHP 8.1 | End of life | No longer released | Yes | No official release. Move to a supported version, or build from the source backport. |
For people who build PHP from source, the PHP security team also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1. They are not official releases.
Linux distributions often fix PHP without changing its version number. If your PHP comes from Debian, Ubuntu, Red Hat, or Alpine packages, check the distribution's security tracker (linked below) rather than the number alone.
How to Check Your PHP Version
Check both the web server and the command line. They can run different versions on the same machine.
On the Command Line
php -vShows the version the command line uses. Your web server can run a different PHP version, so check the web side too.
In a Laravel Application
php artisan aboutOn Laravel 9.21 or newer, this lists the PHP version under Environment. Run it on the server, not your own computer.
With Composer
composer show --platform phpShows the PHP version Composer sees. If composer.json sets config.platform.php, Composer reports that value instead of the real one.
In Docker
docker compose exec app php -vReplace app with the name of the service that runs PHP. For an image you build, the tag in your Dockerfile tells you which PHP version it starts from.
From the Web Server
Save a file containing
<?php phpinfo();in the site's public folder, open it in a browser, and read the version at the top. Delete the file straight away: it shows details about your server that should not stay public.In Your Hosting Control Panel
In cPanel, MultiPHP Manager lists the PHP version each domain uses. In Laravel Forge, the server's PHP tab lists the installed versions. Other hosts usually show it on the site's settings page.
If your server announces its PHP version in the X-Powered-By header, our free Site Stack Detector shows it and flags a version older than the fixed release.
How to Update Safely and Quickly
A security release stays on the same PHP version, so it is a much smaller change than an upgrade to a new version.
- List every place PHP runs: the web server (PHP-FPM or an Apache module), the command line, queue workers, scheduled tasks, and any Docker images.
- Take a backup you can restore, and try the update on a staging copy first if you have one.
- Install the fixed release with your platform's method below.
- Restart PHP-FPM or the web server. In Laravel, run php artisan queue:restart so long-running workers load the new PHP.
- Check the version again, from the web and from the command line, and keep a note of what you changed.
Debian and Ubuntu
sudo apt update && sudo apt upgrade
Packages from the distribution itself usually carry the fix under the same version number, so confirm it in the Debian or Ubuntu tracker. If your PHP comes from the deb.sury.org repositories, follow the steps for those packages below.
Red Hat, AlmaLinux, and Rocky Linux
sudo dnf upgrade 'php*'
The same applies here: distribution packages may keep their version number. Packages from the Remi repository follow the PHP project's numbers, but php.net said on October 21 that Remi would not have the updates that day and urged its users to switch to distribution packages or build from source.
Docker
docker compose build --pull && docker compose up -d
A floating tag such as php:8.4-fpm picks up the fix once the official image is rebuilt. A pinned tag such as php:8.4.26-fpm never changes, so change it to the fixed release.
The official images with the fixed releases were merged in docker-library/php pull request 1694 on October 21, and tags such as php:8.4.27-fpm are on Docker Hub. Confirm with php -v inside the new container.
Laravel Forge
Forge does not patch PHP automatically. On the server's PHP tab, open the menu next to the version and choose Update, as its PHP documentation describes. Forge warns that a few seconds of downtime are possible.
cPanel and Shared Hosting
Your host installs PHP updates. Ask them to confirm the fixed release, or their patched package, is installed for every PHP version your domains use, then check it yourself.
If Your PHP Comes From Ondřej Surý's Repositories
Many Debian and Ubuntu servers install PHP from deb.sury.org instead of the distribution. Fixed packages for every PHP version from 5.6 to 8.5 went out there on October 21.
deb.sury.org is run by Ondřej Surý, the Debian developer who also maintains Debian's own PHP packages. It is his own project, not part of PHP, Debian, or Ubuntu, and he runs it on a best-effort basis. Paid support with a service commitment is available from PHP LTS by Freexian, which he works with.
| PHP version | Fixed package | How it is fixed |
|---|---|---|
| PHP 8.5 | php8.5 8.5.12-1 | The official PHP 8.5.12 release. |
| PHP 8.4 | php8.4 8.4.27-1 | The official PHP 8.4.27 release. |
| PHP 8.3 | php8.3 8.3.36-1 | The official PHP 8.3.36 release. |
| PHP 8.2 | php8.2 8.2.35-1 | The official PHP 8.2.35 release. |
| PHP 8.1 | php8.1 8.1.34-9 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 8.0 | php8.0 8.0.30-25 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 7.4 | php7.4 7.4.33-31 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 7.3 | php7.3 7.3.33-35 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 7.2 | php7.2 7.2.34-66 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 7.1 | php7.1 7.1.33-80 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 7.0 | php7.0 7.0.33-92 | Patch backported by the maintainer. PHP itself no longer releases this version. |
| PHP 5.6 | php5.6 5.6.40-104 | Patch backported by the maintainer. PHP itself no longer releases this version. |
We read the changelog in each of these packages: every one lists CVE-2026-109618 and CVE-2026-109619. The packages are published for Debian 11, 12, and 13 on packages.sury.org, and for Ubuntu 22.04 and 24.04 in the ppa:ondrej/php archive on Launchpad. For Ubuntu 26.04, the maintainer says packages.sury.org is the place to get them. Older releases such as Ubuntu 16.04 get nothing: he said on October 21 he will not patch them. Debian 11 itself is past its end of life, so plan to move off it too.
On Arm servers, check before you rely on it. The maintainer built the usual 64-bit Intel and AMD (amd64) packages first. When we checked on the evening of October 21, many arm64 and armhf packages on packages.sury.org were still the older, unfixed builds, and he expected the rest to take about two days. The Launchpad archive had Arm builds for Ubuntu. Run the check below on every server.
A patched old version is still an old version. The backports close these two flaws, but the PHP project no longer fixes anything in PHP 8.1 or older, so plan the move to a supported version. For PHP 5.6 to 7.1, the maintainer said on October 21 that a follow-up update is coming to add a related piece of an older fix, so run the update again over the next few days.
1. Add the Repository
Skip this if the server already uses it. On Debian, and on Ubuntu 26.04, use the commands from the repository's own instructions. They install its signing key and add it as a package source:
sudo apt-get update
sudo apt-get -y install lsb-release ca-certificates curl
sudo curl -sSLo /tmp/debsuryorg-archive-keyring.deb https://packages.sury.org/debsuryorg-archive-keyring.deb
sudo dpkg -i /tmp/debsuryorg-archive-keyring.deb
sudo sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list'
sudo apt-get updateOn Ubuntu 22.04 or 24.04, add the Launchpad archive instead:
sudo apt-get update
sudo apt-get -y install software-properties-common
sudo add-apt-repository ppa:ondrej/php
sudo apt-get update2. Install the Update
This updates the PHP packages already on the server, and nothing else:
sudo apt-get update
sudo apt-get install --only-upgrade 'php*'3. Restart PHP
Restart PHP-FPM for each version you run, and Apache if it runs PHP itself through mod_php. Change 8.3 to your version:
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache24. Check the Fix Is In
Again, change 8.3 to your version:
php8.3 -v
dpkg-query -W 'php8.3-common'
zgrep CVE-2026-109618 /usr/share/doc/php8.3-common/changelog.Debian.gz The package version should match the table above or be newer, and the last command should print a line naming CVE-2026-109618. If it prints nothing, the fix is not installed. On PHP 8.2 to 8.5, php -v shows the fixed release, such as 8.3.36. On PHP 8.1 and older it still shows the same number as before, such as 7.4.33, so rely on the package version and the changelog line instead.
We tested these steps on October 21 in clean Debian 12, Debian 13, and Ubuntu 24.04 containers. Each one installed the fixed packages and showed the changelog line.
If Your Site Is Behind Cloudflare
Cloudflare added firewall rules for these flaws. They help while you update, but they do not replace the update.
- Cloudflare says its web application firewall has blocked these attacks by default since 11:02 PM Eastern on October 20 (03:02 UTC on October 21), on free and paid plans. On the Free plan you do not need to do anything. On Pro, Business, and Enterprise, Cloudflare asks you to check that its Cloudflare Managed Ruleset is deployed and set to block.
- On October 21 Cloudflare also launched full transaction detection, which looks at each request together with your server's reply, and response rules, which can stop that reply before it reaches the attacker. It is available on every plan, including Free. Its php2shell rule is in the Cloudflare Managed Response Firewall Default ruleset, which Cloudflare says runs on every request by default.
- To check, open Security, then Security Rules in the Cloudflare dashboard. Confirm the managed rules are deployed, and at the bottom of the page, that Cloudflare Managed Response Firewall Default is deployed. To see what was blocked, open Security, then Security Analytics, then Events.
- The rules only see traffic that passes through Cloudflare. If your server can also be reached directly, those requests skip them. A response rule also cannot undo something an attack already did on your server.
- Cloudflare itself says to update PHP and keep the firewall on as an extra layer. Dane Knecht of Cloudflare announced the new capability on X.
If You Can't Update Today
These steps lower the risk for a short while. None of them replaces the update.
- CVE-2026-109618: Set memory_limit=-1 where applications can't override it (php_admin_value in the FPM pool or Apache configuration) and check nothing sets a finite limit back. Keep post_max_size low (8M without uploads, 32M with them) and limit request size at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA. This reduces exposure but does not make PHP safe.
- CVE-2026-109619: Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration (not ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request settings. Hiding errors does not help. This blocks the confirmed paths only.
- Restart every PHP worker after a configuration change, and check that no pool, directory, or application setting puts the old value back.
- If an internet-facing PHP site cannot be updated soon, consider taking it offline until it can, as CERT-EU advises.
- Watch your error and access logs for unusual requests until the update is in.
- Put the update on the calendar with a named person and a date.
Timeline
- Oct 20, 2026, 3:33 PM Eastern (19:33 UTC). The PHP security team announces the security release and its two critical vulnerabilities.
- October 21, 2026, 9:34 AM Eastern (13:34 UTC). The PHP project publishes both advisories on GitHub and announces PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, ahead of the 10:00 AM Eastern (14:00 UTC) time it had scheduled.
- Oct 27, 2026. We last checked the sources on this page.
Official Resources
- The PHP release announcement (php.net)
- PHP 8 ChangeLog (php.net)
- PHP downloads (php.net)
- Upcoming Critical PHP Security Release, 20 October (php.announce)
- PHP supported versions (php.net)
- CVSS v4.0 specification (FIRST)
- CVE-2026-109618 advisory
- CVE-2026-109618 in the National Vulnerability Database
- CVE-2026-109619 advisory
- CVE-2026-109619 in the National Vulnerability Database
Linux Distribution Trackers
Vetted Resources
Guides and tools we have read and checked against the official advisory. We add to this list as the response develops.
Status and Timeline
Upcoming Critical PHP Security ReleaseOfficial
The advance notice from 20 October 2026: a security release fixing two critical vulnerabilities, both CVSS v4.0 9.2. The release came out on 21 October.
CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHPVetted
Government CERT advisory: find every PHP application you run, patch as soon as fixed versions ship, and take internet-facing PHP apps off the public network if you cannot patch right away.
Security Advisory: Critical Remote Code Execution Vulnerabilities, Update NowOfficial
The release notice: who is at risk, the fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, how to update, and the short-term measures that reduce exposure if you cannot update today.
NVD: CVE-2026-109618Official
The US government record for the first flaw, published 21 October. It keeps PHP's CVSS 4.0 score of 9.2 and adds NIST's own CVSS 3.1 score of 9.8. The record for CVE-2026-109619 is at the same address with that id.
deb.sury.org Issue 145: Critical PHP Security ReleaseVetted
The maintainer's own build updates: fixes for every PHP version in the repository on all supported Debian and Ubuntu releases, amd64 first and Arm builds expected to take about two days; no patches for Ubuntu 16.04.
Amazon Threat Intelligence: PHP2Shell Exploitation Before Public DisclosureVetted
Amazon saw an attempt to exploit these flaws against its honeypot sensors on October 17, four days before public disclosure, and says it now sees broad exploitation attempts. It does not say whether any attempt succeeded. Amazon recommends checking servers for signs of attack from at least October 17, not from the release date.
CISA: Critical Vulnerabilities in PHP Require Immediate PatchingVetted
The US cyber agency urges everyone to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, starting with sites that face the internet. If you cannot update, or you run PHP 8.1 or older, CISA says to take those systems offline until they are fixed. It also says to watch for PHP worker processes starting shells or downloading tools. When it first published, CISA had not seen a successful attack. On 26 October it updated the alert and added both flaws to its Known Exploited Vulnerabilities catalog, which means it now has evidence they are being exploited. Its 23 October update adds a detection rule your security team or log tool can import, from CISA's SIGMA_Rules repository on GitHub, and links to alerts from the NSA and the UK, Dutch, Australian, New Zealand and Canadian cyber centres.
CISA Adds Both PHP Flaws to Its Known Exploited Vulnerabilities CatalogVetted
On 26 October CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog, its list of flaws attackers are actually using. US federal agencies have until 29 October to fix them. CISA has not said who was attacked. If any of your PHP servers are still on an older version, treat them as a target now: update PHP, restart it, and check those servers for signs of attack going back to at least 17 October.
Unit 42: Threat Brief on CVE-2026-109618 and CVE-2026-109619 (Government Case Retracted)Vetted
Unit 42 had described an attack on a European government organization as PHP2Shell exploitation. On 25 October it retracted that update: the attackers did get in through a vulnerable PHP application, but Unit 42 cannot confirm these two flaws were the way in. Treat it as a reminder that one report is not proof, and keep the basics: update PHP, restart PHP, then check your web servers for unexpected shells or new files.
Honeypot Report: PHP2Shell Attacks That Reached a ShellVetted
On 24 October a researcher running decoy servers on PHP 8.4.26 with Apache mod_php recorded 35 attacks from two internet addresses that started a command shell as the web server user. It is the most detailed public evidence so far that the publicly shared exploit works outside a lab, though the decoys used a deliberately easy single-worker setup. The report lists what to search your logs for: memory exhausted errors in Unknown on line 0, oversized PHPSESSID cookies, and shells started by Apache. Update PHP first.
FBI Public Service Announcement: Critical Vulnerability Alert, PHP CoreVetted
A short FBI notice written for business owners and website operators. It says to update PHP right away following php.net, list everywhere PHP runs including products from vendors that bundle it, take a system offline if you cannot update it yet, and watch for PHP starting command shells or downloading files.
CISA Lists the Linux Kernel Flaw Attackers Chain With the PHP FlawsVetted
On 28 October CISA added CVE-2026-46300, a Linux kernel flaw known as Fragnesia, to its Known Exploited Vulnerabilities catalog. CISA says it can be chained with the two PHP flaws to plant a PHP web shell and run commands as root, which means full control of the server rather than just the web app. US federal agencies have until 31 October to fix it. Updating PHP closes the way in, but also install your Linux distribution's kernel update and reboot, since a server that was already reached through PHP could have been taken over completely.
The Record: Limited Reports of PHP Bug Exploitation EmergeVetted
A 29 October roundup of the first reports of attacks that worked. GreyNoise says it saw at least six successful attacks, the first on one of its own test servers on 28 October, and that attackers have to tailor the exploit to each server's setup, which makes mass attacks hard. Dream Research describes 24 firewalls taken over between 23 and 24 October. Hard to mass exploit is not the same as safe: update PHP and check servers that sat unpatched.
Wordfence: Still No Confirmed WordPress CompromisesVetted
As of 28 October, Wordfence, which protects more than 5 million WordPress sites, knew of no WordPress site taken over through these PHP flaws. It still recorded about 77,600 attack requests from more than 2,000 addresses between 23 and 27 October, trying to read wp-config.php and .env passwords and drop backdoor files. Updating WordPress does not update PHP, so ask your host or developer to move the server to a fixed PHP version and restart PHP.
Affected and Fixed Versions
PHP Supported VersionsOfficial
Which PHP branches still get security fixes and until when; PHP 8.1 and older are end of life.
PHP 8 ChangeLog: 8.5.12, 8.4.27, 8.3.36, 8.2.35Official
Every change in the fixed releases. On 8.3 and 8.2 the two security fixes are the only changes; 8.5 and 8.4 also carry their regular bug fixes.
Monitor and Detect
Process Watcher: Watch What PHP StartsVetted
Open-source Linux eBPF tool (GPL-3.0) that logs every program PHP or your web server starts, with optional kill rules. Detection only; it does not replace the PHP update. Needs root and Linux 5.15 or newer with BTF.
Watching PHP With Process Watcher (October 2026 Kit)Vetted
Ready-made configurations and a short guide for watching PHP-FPM, Apache mod_php, CGI, and CLI with process-watcher until the fix is installed.
CrowdStrike: Detection Notes for the PHP RCE FlawsVetted
A useful log check for anyone: in your web server error logs, look for Allowed memory size of N bytes exhausted together with in Unknown on line 0. That pairing means PHP ran out of memory before your code ran and may point to exploit attempts.
Datadog Security Labs: PHP2Shell Detection, Analysis and RemediationVetted
What to look for in your logs: large form submissions, PHP errors that say Allowed memory size exhausted in Unknown on line 0 (PHP ran out of memory before your code started), upstream connection resets, and unexpected shell processes started by the web server. Notes that a successful attack does not always crash the worker.
Sophos: PHP2Shell Exploit Attempts and Indicators to Search forVetted
Sophos first reported one successful attack on 22 October, then corrected that the same day: its customers saw scanning and a small number of failed attempts, and it has no evidence of a successful compromise. The blocked attempts tried to install a botnet program. Its post lists the addresses, domains, file hashes and a user agent (php2shell-scan/109618) you can search your logs and servers for. Sophos says a working exploit is hard to build but expects attackers to keep trying, so updating PHP is still the first step.
Morphisec: Attack on a Windows IIS Server Running PHPVetted
Morphisec reports one customer case on Windows: the IIS worker started php-cgi.exe, which opened a command prompt and ran a program that tried to connect out to the attacker. Its security agent stopped the program. This is one reported case, not a broad campaign. If you run PHP on Windows, update PHP, restart the IIS application pools, and look for php-cgi.exe starting cmd.exe or PowerShell.
Mitigate Before Patching
GHSA-w8hw-w9fx-j79w: RCE via OOM Corruption (CVE-2026-109618)Official
Full technical advisory for the out-of-memory flaw, with the affected range for each branch, the CVSS v4.0 vector, and configuration measures for installations that cannot update yet.
GHSA-6wmf-4rv5-p3rp: RCE via Stale Global State (CVE-2026-109619)Official
Full technical advisory for the stale state flaw, including the session upload progress and PHP 8.5 fatal error backtrace paths, mitigations, and a logging and configuration audit checklist.
Cloudflare Deploys Protections Against php2shellOfficial
Sites behind Cloudflare's WAF, including the free plan, have been protected by default since 21 October 03:02 UTC. Cloudflare says it saw attack traffic aimed at its customers after the leak and still tells everyone to update PHP.
Cloudflare: Introducing Full Transaction DetectionOfficial
Cloudflare's new firewall feature that checks a request together with the server's reply, and response rules that can block that reply. Available on all plans including Free; the php2shell rule sits in the Cloudflare Managed Response Firewall Default ruleset. It does not replace updating PHP.
PHP Informational Advisory: Session Upload Progress (CVE-2026-115560)Official
On 23 October PHP disclosed a third, unlikely remote code execution path that the 21 October updates do not fix. It only applies when an application switches session.serialize_handler to php at runtime with ini_set() before session_start() while session upload progress is on. PHP suggests setting session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool until the next regular release. If you already set it for CVE-2026-109619, keep it; nothing else is needed.
NCSC-NL php2shell RepositoryVetted
The Dutch government's cyber centre keeps a public list of software products that bundle PHP, with each supplier's fix status, plus a script for cPanel servers that applies PHP's temporary settings in one place and restarts Apache and PHP-FPM. Read the script and test it before you run it as root. It does not replace updating PHP, and its list of community tools is not reviewed by NCSC-NL.
Upgrade Paths by Platform
Laravel Forge: Patching PHP VersionsOfficial
How to apply a PHP patch release on a Forge server from the PHP tab; Forge does not patch PHP automatically.
Minimal Source Backports for PHP 7.4, 8.0, and 8.1Official
Unofficial source patches for end-of-life branches, for people who build PHP from source and have no long-term support vendor. Branches for 7.4 and 8.0 sit alongside this 8.1 branch. Moving to a supported version is still the safe path.
Ubuntu: CVE-2026-109618 Status by ReleaseOfficial
Ubuntu rates it critical priority and lists the status of each php package per Ubuntu release. The companion page for CVE-2026-109619 is at the same address with that id.
Official Docker PHP Images: Update to the Fixed ReleasesOfficial
The change that moved the official php images to 8.5.12, 8.4.27, 8.3.36, and 8.2.35. It was merged on 21 October and the new tags are on Docker Hub, so pull the new image, rebuild, and redeploy your containers.
Debian DSA-6574-1: php8.4 Security UpdateOfficial
Fixed php8.4 for Debian 13 (trixie), version 8.4.27-1~deb13u1. Debian 12 (bookworm) gets php8.2 8.2.35-1~deb12u1 from its security repository; the Debian tracker lists both.
Ubuntu USN-8948-1 and USN-8948-2: PHP VulnerabilitiesOfficial
Ubuntu's fixed PHP packages, including 24.04 LTS (php8.3 8.3.6-0ubuntu0.24.04.13) and 22.04 LTS (php8.1 8.1.2-1ubuntu2.28). A normal system update installs them; restart PHP-FPM or Apache afterwards.
deb.sury.org PHP Packages for Debian and UbuntuVetted
Fixed packages for every PHP version from 5.6 to 8.5 on Debian 11 to 13 and Ubuntu 22.04 to 26.04, published 21 October. PHP 8.1 and older carry a backported patch, not a PHP release. A third-party repository run on a best-effort basis by the Debian PHP maintainer; we read every package changelog and installed it in test containers.
Ondřej Surý's PHP Archive on LaunchpadVetted
ppa:ondrej/php, the Ubuntu 22.04 and 24.04 archive for the same packages, with fixed builds for every PHP version from 5.6 to 8.5 on 21 October, including Arm. Ubuntu 26.04 uses packages.sury.org instead.
Red Hat: CVE-2026-109618Official
Red Hat shipped fixed PHP packages for RHEL 8, 9 and 10 on 21 October (RHSA-2026:87070, 87071, 87072, 87073, 87079, 87080 and 87151). Run dnf update and restart PHP. Some streams, such as the RHEL 9 php:8.4 module, were still listed as affected when we checked on 22 October.
Remi's RPM Repository: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12Vetted
Fixed PHP builds for Fedora 43 and newer and for Enterprise Linux 8 and newer (RHEL, Alma, Rocky, CentOS), x86_64 and aarch64, published 22 October. If your server gets PHP from Remi's repository, run your normal dnf update and restart PHP.
PHP for Windows: Updated Builds for a Brotli FixOfficial
On 26 October the PHP team rebuilt its Windows downloads as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to fix a separate bug in the bundled Brotli compression library (CVE-2026-111497). It can only be reached through cURL when an app turns on automatic decompression of web responses, which is off by default. The PHP version number does not change, so if you run PHP on Windows, check that your package has the -1 suffix. Linux servers get this fix from their own system updates. On 27 October CISA added CVE-2026-111497 to its list of known exploited vulnerabilities. CISA did not say which products were attacked, so treat the -1 Windows builds and your Linux Brotli updates as urgent.
Palo Alto Networks: PHP Flaws in PAN-OS Firewalls and PanoramaOfficial
Palo Alto firewalls and Panorama use PHP in their management web page and API, and every PAN-OS 10.2 to 12.2 release before its hotfix is affected. On 27 October Palo Alto raised its rating to Critical, and its advisory now says attackers are going after management pages that can be reached from the internet. If you or your IT provider run a Palo Alto firewall, make sure the management page only answers from trusted internal addresses, then install the hotfix the advisory lists for your version. As of 29 October every hotfix in the advisory is out. On 29 October Palo Alto's Unit 42 team said it had checked the attacker's tools from the firewall campaign Dream Research reported, where the PHP flaws were chained with a Linux kernel flaw to get root, and Dream's updated post now names PAN-OS as the firewall in that campaign. Unit 42 also said that about 0.02 percent of Palo Alto's installed base, all with management pages open to the internet, was hit. Palo Alto says customers on the fixed versions are not affected. This is a reminder that firewalls and other appliances can carry PHP too, so ask each vendor whether their product is affected.
Plesk: Fixed PHP Builds for PHP2ShellOfficial
If your site runs on a Plesk server, every PHP version Plesk ships was affected. Fixed builds are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Linux and Windows. Older PHP 7.4, 8.0 and 8.1 builds on Linux keep the same version number, so the fix is only in builds dated 21 October 2026 or later. Plesk itself needs Obsidian 18.0.81 Update 4 or 18.0.80 Update 11.
cPanel: Critical PHP Security ReleaseOfficial
For cPanel and WHM servers. EasyApache 4 has fixed packages for PHP 7.4 through 8.5, including backported fixes for 7.4, 8.0 and 8.1 that keep their old version numbers. cPanel lists the update commands and a changelog check that shows whether a server has the fix.
Google Cloud: Patching PHP on App Engine, Cloud Run and GKEOfficial
If your PHP app runs on Google Cloud, Google says supported App Engine standard runtimes are patched for you, but PHP 8.1 or older must move to 8.2 or newer and be redeployed. On App Engine flexible, Cloud Run and GKE you rebuild your image with a fixed PHP version and redeploy, unless automatic base image updates are on. Marketplace stacks such as WordPress need the vendor's update or a PHP update.
Verify After Upgrade
PHP Bug GH-24488: SimpleXML Crash After Updating to 8.4.27 or 8.5.12Official
After the security update, PHP 8.4.27 and 8.5.12 can crash a worker with zend_mm_heap corrupted when code that uses SimpleXML (for example json_encode on an XML object) runs garbage collection. 8.3.36 and older are not affected. PHP committed the fix on 22 October; it ships in the next 8.4 and 8.5 releases. Test XML imports and feeds after you update, and do not roll back the security fix.
Discussion and Analysis
Huntress Rapid Response: Leaked Critical PHP VulnerabilitiesVetted
Plain-language background on the leak and what to do now: inventory every PHP install, including ones inside vendor software, patch the moment fixes land, and isolate end-of-life PHP from the internet.
Wiz Research: PHP2ShellVetted
Background from the research team that says it found and reported the flaws in August 2026, with its disclosure timeline. It says the issues reach back to PHP 5.4 and can also leak memory from other requests.
The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP SecurityOfficial
Plain explanation of both flaws from the organization that funds PHP's core development, and how they were found and fixed. It says to update now and points to php.net for the update steps.
Wiz Research: PHP2Shell Exploitation Attempts and Remediation TrendsVetted
A 27 October update from the research team that reported the flaws. Wiz counts about 67% fewer vulnerable servers exposed to the internet each day since disclosure, but says about half of the organizations first affected still had at least one vulnerable server a week later. Its own sensors had not seen a complete successful attack, and it calls the honeypot report from Adel Karimi the strongest public evidence so far. Patch even if your traffic looks quiet.
Get Help Updating PHP Quickly
Bracken East keeps PHP and Laravel applications up to date for businesses, including sites whose original developers have moved on. For this release, we can:
Find the exact PHP version on every server and container your site uses.
Install the fixed release, or plan the move to a supported version if you are on PHP 8.1 or older.
Restart PHP and its workers, then confirm the fixed version is live.
Send you a short written note of what changed and what we checked.
PHP Security Release Questions, Answered
Is my website affected?
If it runs PHP, check. Find the exact PHP version your site runs and compare it with the fixed release for its version in the table on this page. Anything older than the fixed release should be updated.
How quickly should we update?
Today if you can. Both vulnerabilities are rated Critical, the highest CVSS band, they allow remote code execution without a login, and the PHP project says updating is the only safe choice.
Will updating break our site?
A security release stays on the same PHP version, for example from one 8.3 release to a later 8.3 release, so it is a much smaller change than moving to a new version. Try it on a staging copy first if you have one, and keep a backup you can restore.
Our host manages PHP for us. Do we need to do anything?
Confirm it. Ask your host whether the fixed release, or their patched package, is installed on your server, then check the version yourself afterward.
We run PHP 8.1 or older. What now?
PHP 8.1 stopped receiving security fixes on December 31, 2025, and older versions stopped earlier, so the PHP project will not publish fixed releases for them. It did publish minimal source backports for PHP 7.4, 8.0, and 8.1 for people who build from source, and some Linux distributions and long-term support vendors ship their own fixes. The safe path is still moving to a supported version, one step at a time.
Can you do the update for us?
Yes. We can find the PHP version on every server and container your site uses, install the fixed release, restart what depends on it, and confirm the fix is live. Book a free call or send us a message to get started.
Get Your PHP Onto a Fixed Release.
Book a free 45-minute call. We will look at how your site runs PHP and tell you plainly what the update involves.