{"id":9216,"date":"2026-10-22T08:12:00","date_gmt":"2026-10-22T02:42:00","guid":{"rendered":"https:\/\/www.veeble.com\/kb\/?p=9216"},"modified":"2026-10-22T08:12:00","modified_gmt":"2026-10-22T02:42:00","slug":"critical-php-vulnerabilities-2026","status":"publish","type":"post","link":"https:\/\/www.veeble.com\/kb\/critical-php-vulnerabilities-2026\/","title":{"rendered":"Critical PHP Vulnerabilities (CVE-2026-109618 &amp; CVE-2026-109619): Update Immediately"},"content":{"rendered":"\n<p>Two critical security vulnerabilities have been discovered in PHP, putting websites and servers running unpatched PHP versions at risk.<\/p>\n\n\n\n<p>The vulnerabilities, identified as <strong>CVE-2026-109618 and CVE-2026-109619<\/strong>, were publicly disclosed on 21 October 2026. Both carry a critical severity score of <strong>9.2 out of 10 (CVSS v4.0)<\/strong>.<\/p>\n\n\n\n<p>These flaws could allow attackers to execute malicious code on vulnerable servers without needing login credentials. The PHP development team has already released security patches, and users are strongly advised to update their installations immediately.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"what-are-these-php-vulnerabilities\">What Are These PHP Vulnerabilities?<\/h2>\n\n\n<p>The vulnerabilities affect PHP itself, rather than a particular website, plugin or content management system.<\/p>\n\n\n\n<p>Here&#8217;s a quick explanation of the two security flaws:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618 \u2013 Out-of-Memory Corruption:<\/strong> Improper handling of memory allocation failures can corrupt PHP&#8217;s internal request data, potentially allowing an attacker to execute malicious code.<\/li>\n\n\n\n<li><strong>CVE-2026-109619 \u2013 Stale Global State:<\/strong> PHP may reuse internal data after its memory has been freed. Under certain conditions, attackers can exploit this behaviour to execute unauthorised code.<\/li>\n<\/ul>\n\n\n\n<p>Both vulnerabilities can potentially be exploited remotely without authentication.<\/p>\n\n\n\n<p>A successful attack could allow an attacker to modify website files, access sensitive information, disrupt services or compromise applications running on the affected server.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"which-php-versions-are-affected\">Which PHP Versions Are Affected?<\/h2>\n\n\n<p>PHP installations running versions from PHP 5 onwards should be considered potentially vulnerable unless the relevant security fixes have been applied.<\/p>\n\n\n\n<p>The PHP development team released the following patched versions on 21 October 2026:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>PHP Version<\/th><th>Patched Version<\/th><\/tr><tr><td>PHP 8.5<\/td><td>8.5.12<\/td><\/tr><tr><td>PHP 8.4<\/td><td>8.4.27<\/td><\/tr><tr><td>PHP 8.3<\/td><td>8.3.36<\/td><\/tr><tr><td>PHP 8.2<\/td><td>8.2.35<\/td><\/tr><tr><td>PHP 8.1 and earlier<\/td><td>No official release; vendor backports may be available<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>Important:<\/strong> PHP 8.1 and older versions no longer receive regular security releases from the official PHP project. However, some Linux distributions and hosting control panel vendors provide security patches for older PHP versions.<\/p>\n\n\n\n<p>For example, cPanel has released security fixes for EasyApache PHP 7.4, 8.0 and 8.1 through backported updates. This means a server running an older PHP version may already be protected if the appropriate vendor patch has been installed.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-protect-your-website-or-server\">How to Protect Your Website or Server<\/h2>\n\n\n<p>The most effective way to protect against these vulnerabilities is to install the latest applicable PHP security updates.<\/p>\n\n\n<h3 class=\"wp-block-heading\" id=\"1-check-your-current-php-version\">1. Check Your Current PHP Version<\/h3>\n\n\n<p>If you have access to your server through SSH, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>php -v<\/code><\/pre>\n\n\n\n<p>This command displays the PHP version installed for the command-line environment.<\/p>\n\n\n\n<p>If you use cPanel, you can also check the PHP version assigned to your website under <strong>MultiPHP Manager<\/strong>.<\/p>\n\n\n\n<p>Keep in mind that the command-line PHP version and the version used by your website may be different.<\/p>\n\n\n<h3 class=\"wp-block-heading\" id=\"2-install-the-latest-php-security-updates\">2. Install the Latest PHP Security Updates<\/h3>\n\n\n<p>Update PHP to the latest patched release available for your environment.<\/p>\n\n\n\n<p>For servers running Ubuntu or Debian, you can check for available security updates using:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt upgrade<\/code><\/pre>\n\n\n\n<p>These commands update system packages more broadly, so review the proposed changes before proceeding.<\/p>\n\n\n\n<p>For servers using other Linux distributions, follow the official security update instructions provided by your operating system vendor.<\/p>\n\n\n\n<p><strong>Note:<\/strong> Some Linux distributions backport security patches without changing the main PHP version number. Always check the installed package release and the vendor&#8217;s security advisory before determining whether a system is vulnerable.<\/p>\n\n\n<h3 class=\"wp-block-heading\" id=\"3-updating-php-on-cpanelwhm-servers\">3. Updating PHP on cPanel\/WHM Servers<\/h3>\n\n\n<p>cPanel released security updates on 21 October 2026 addressing both vulnerabilities in its internal PHP components and EasyApache 4 packages.<\/p>\n\n\n\n<p>If you manage a cPanel\/WHM server, ensure that both cPanel &amp; WHM and the installed EasyApache PHP packages are updated.<\/p>\n\n\n\n<p>You can update cPanel &amp; WHM through <strong>WHM \u2192 cPanel \u2192 Upgrade to Latest Version<\/strong>.<\/p>\n\n\n\n<p>Alternatively, server administrators with root SSH access can run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/local\/cpanel\/scripts\/upcp --force<\/code><\/pre>\n\n\n\n<p>Next, refresh the package repository metadata:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>yum clean all &amp;&amp; yum makecache<\/code><\/pre>\n\n\n\n<p>Then update the EasyApache RPM packages:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/scripts\/rpmup<\/code><\/pre>\n\n\n\n<p>To verify whether the security fix has been applied to an EasyApache PHP package, check its changelog. For example, for PHP 7.4:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rpm -q --changelog ea-php74-php-cli | grep -m1 CVE-2026-109618<\/code><\/pre>\n\n\n\n<p>If the security fix is present, the output should contain a changelog entry referring to the vulnerability. Replace <code>ea-php74<\/code> with the installed PHP package name when checking other versions.<\/p>\n\n\n\n<p>These commands are intended for server administrators with root access, not individual shared hosting accounts.<\/p>\n\n\n<h3 class=\"wp-block-heading\" id=\"4-verify-the-update\">4. Verify the Update<\/h3>\n\n\n<p>After applying the patches:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm that the relevant PHP packages contain the security fixes.<\/li>\n\n\n\n<li>Ensure your web server and PHP-FPM workers, where applicable, are using the updated PHP runtime.<\/li>\n\n\n\n<li>Test your websites and important application functions.<\/li>\n\n\n\n<li>Check application and server logs for unexpected errors or suspicious activity.<\/li>\n<\/ul>\n\n\n\n<p>If you are using shared hosting and cannot manage server-level PHP updates yourself, contact your hosting administrator to confirm that the required security patches have been applied.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"can-these-vulnerabilities-be-fixed-without-updating-php\">Can These Vulnerabilities Be Fixed Without Updating PHP?<\/h2>\n\n\n<p>Not completely.<\/p>\n\n\n\n<p>The PHP security team has suggested temporary measures that may reduce exposure to certain attack methods. For example, disabling <code>session.upload_progress.enabled<\/code> can help block confirmed exploitation paths associated with CVE-2026-109619 when configured correctly at the server level.<\/p>\n\n\n\n<p>However, <strong>changing this PHP setting does not fully protect against both vulnerabilities<\/strong>.<\/p>\n\n\n\n<p>Web application firewalls (WAFs), request restrictions and other security controls may also help reduce the risk while updates are being applied.<\/p>\n\n\n\n<p>These measures should only be considered temporary precautions. Installing the appropriate security patches remains the only complete solution.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"does-updating-wordpress-or-other-applications-fix-the-issue\">Does Updating WordPress or Other Applications Fix the Issue?<\/h2>\n\n\n<p>No. These vulnerabilities exist in the PHP runtime itself.<\/p>\n\n\n\n<p>Even if WordPress, Joomla, Drupal, Laravel or other PHP-based applications are fully updated, the server may still be vulnerable if it uses an unpatched PHP installation.<\/p>\n\n\n\n<p>Make sure both your applications and their underlying PHP environment receive the necessary updates.<\/p>\n\n\n<h2 class=\"wp-block-heading\" id=\"final-recommendation\">Final Recommendation<\/h2>\n\n\n<p>These are serious PHP vulnerabilities, and delaying security updates can leave websites and applications exposed to unnecessary risks.<\/p>\n\n\n\n<p>If you manage a website or server running PHP, <strong>check its patch status and apply the appropriate updates as soon as possible<\/strong>.<\/p>\n\n\n\n<p>For older PHP versions, confirm whether your operating system or hosting platform has released backported security patches. If your version is no longer supported and no security patch is available, plan an upgrade to a supported PHP release.<\/p>\n\n\n<h3 class=\"wp-block-heading\" id=\"official-references\">Official References<\/h3>\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-1\" target=\"_blank\" rel=\"noopener\">PHP Security Advisory \u2013 21 October 2026<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619\" target=\"_blank\" rel=\"noopener\">cPanel Security Advisory \u2013 CVE-2026-109618 and CVE-2026-109619<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.digitalocean.com\/blog\/critical-php-rce-vulnerabilities-patch-now\" target=\"_blank\" rel=\"noopener\">DigitalOcean \u2013 Critical PHP RCE Vulnerabilities: Patch Now<\/a><\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Two critical security vulnerabilities have been discovered in PHP, putting websites and servers running unpatched PHP versions at risk. The vulnerabilities, identified as CVE-2026-109618 [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[10,9,5],"tags":[136,140,138,139],"class_list":["post-9216","post","type-post","status-publish","format-standard","hentry","category-php","category-firewallsecurity","category-linux","tag-cve-2026-109618","tag-how-to-patch-php-vulnerabilities","tag-php-security-update-2026","tag-php-vulnerability-fix"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Nasarul Naseer","author_link":"https:\/\/www.veeble.com\/kb\/author\/nasarulnaseer\/"},"uagb_comment_info":0,"uagb_excerpt":"Two critical security vulnerabilities have been discovered in PHP, putting websites and servers running unpatched PHP versions at risk. The vulnerabilities, identified as CVE-2026-109618 [&hellip;]","_links":{"self":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/9216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/comments?post=9216"}],"version-history":[{"count":3,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/9216\/revisions"}],"predecessor-version":[{"id":9219,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/posts\/9216\/revisions\/9219"}],"wp:attachment":[{"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/media?parent=9216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/categories?post=9216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.veeble.com\/kb\/wp-json\/wp\/v2\/tags?post=9216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}