Critical PHP vulnerabilities: find, patch and verify every server
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution; the fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What happened
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both are rated Critical (CVSS 4.0 score 9.2) and allow unauthenticated remote code execution with the web server worker’s privileges; every PHP version below the fixed releases is affected.
Technical details are reported to have leaked ahead of a coordinated disclosure planned for later in the week, and CERT-EU and the Australian Signals Directorate have reportedly advised organizations to prepare for immediate patching. PHP’s own guidance is blunt: “There are no complete mitigations, updating is the only safe choice.”
Sources: php.net release notes · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp
Are you affected?
Answer these for every server, container and hosting account you run. Apache mod_php is confirmed exploitable, and PHP-FPM is also at risk.
What to do in the next 24 hours
Interim mitigations, such as disabling session upload progress or enforcing memory limits, are partial. They buy time; they do not remove the risk.
How Ontrac helps
PHP Security Assessment
Emergency Patching Assistance
End-of-Life Upgrade Plan
Ongoing Patch Management
How it works
Why Ontrac
Frequently asked questions
What are CVE-2026-109618 and CVE-2026-109619?
Two critical remote code execution vulnerabilities in PHP itself, rated 9.2 on CVSS 4.0 and reportedly dubbed PHP2Shell in coverage of the disclosure. Neither requires authentication to exploit. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is my WordPress site affected?
If the server it runs on uses a vulnerable PHP version, yes. These are flaws in PHP itself, not in WordPress, so they affect WordPress, Drupal, Magento, Laravel and custom PHP applications alike. What matters is the PHP version on the server, not the CMS version.
Will a plugin update fix it?
No. Plugin and theme updates do not change the PHP runtime on the server, which is where these vulnerabilities live. The server’s PHP version has to move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
What if I’m on PHP 8.1 or older?
PHP 8.1 and older are end of life and will not receive a fix. Those systems need an upgrade to a supported PHP branch, not a patch. We plan and run that upgrade, including a compatibility check of your application code.
Can a WAF or config change protect me instead of patching?
No. PHP states there are no complete mitigations and that updating is the only safe choice. Configuration measures such as disabling session upload progress or enforcing memory limits are partial and only buy time while you patch.
How do I check which PHP version my server runs?
Run php -v on the server or check the PHP settings in your hosting panel, and confirm what the web workers are actually serving, since CLI and web can differ. On managed hosting, ask your provider to confirm in writing that the fixed build is live. If you can’t verify every server quickly, that is exactly what our assessment does.
