CVE-2026-109618 and CVE-2026-109619: how to patch PHP

PHP published on October 21, 2026 fixes for two critical unauthenticated remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The official fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On Linux distributions, the patch may also arrive as a package revision that keeps the base version.

The useful question is which PHP serves each website and whether its processes already run the fix. The CLI version and the web server version may differ.

What they fix

The first flaw affects the handling of out-of-memory conditions. The second allows internal state from a request to be reused after the memory backing it has been freed. The PHP advisory considers mod_php the highest-risk case; FPM, CGI, LiteSpeed and FrankenPHP are also included among the affected installations.

Mitigating is not the same as patching

Disabling session.upload_progress.enabled reduces one of the known paths. It must be done in a configuration loaded before the request is parsed and by retiring the previous workers; ini_set() and .user.ini are not useful for that measure.

The advisory also covers POST and file limits, and memory management changes with specific conditions. These are partial measures: some, such as removing PHP's memory limit, require an external limit so as not to compromise availability. The complete solution is to update the engine.

The patch depends on the origin of PHP

Ubuntu and Debian. Check the package revision and your distribution's security advisory. For example, Ubuntu 22.04 fixed these flaws in 8.1.2-1ubuntu2.28, even though the base version remains 8.1.2. Do not rule out a backport because the number looks old, and do not assume a package is fixed just because of its date.

Third-party repositories. Identify the specific channel and its fixed revision. Surý distinguishes the Ubuntu PPA from the Debian repository packages.sury.org/php: they are not interchangeable. If there are signature errors, validate the keys with the provider; do not disable verification or switch repositories blindly.

Hosting panels. cPanel, Plesk, DirectAdmin and CloudLinux can maintain several PHP versions in parallel. Check the handlers of all domains that serve traffic. In shared hosting, selecting another unpatched branch does not solve the problem: the update may depend on the provider.

Virtual machines and cloud. The patch is applied inside each machine that runs PHP. Updating the hypervisor or the host system does not update the guests.

Containers. Rebuild the image with a fixed base or packages and replace the containers, including worker and task containers. An old image still retains its PHP even if the host is updated.

How to verify the result

Confirm that the installed package matches a fixed version or a documented backport.
Restart or replace the affected processes. With mod_php, a graceful reload may retain the old library.
Verify the runtime that responds to the website. A temporary diagnostic must be restricted, show only what is necessary and be removed when finished.
Check critical pages and operations and monitor for new errors and 5xx responses.

If the PHP branch is no longer supported, prepare a migration in an isolated copy: code, sanitized test data, extensions and equivalent configuration. Also test forms, authentication and administration. Compatibility depends on the application and its dependencies; it is not enough for the home page to load.

Skills to do it with an agent

PHP CVE Audit: inventory and exposure checking in read-only mode.
PHP CVE Fix: patching through the correct channel, temporary mitigation and process verification.
PHP Version Upgrade: branch migration with functional comparison and rollback plan.