On October 21, 2026, the PHP development team disclosed two critical vulnerabilities in the PHP core (CVE-2026-109618 / CVE-2026-109619) and released fixed versions. Both are rated CVSS 9.2 and may allow unauthenticated attackers to execute arbitrary code remotely. Exploitation attempts have already been reported, so prompt action is required.
■ Fixed versions
PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
Earlier versions are affected. PHP 8.1 and older are end-of-life and no longer receive updates from the PHP project.
■ Recommended actions
- Update to a fixed PHP release and restart your web server (PHP-FPM, Apache, etc.)
- As an interim measure based on PHP’s official advisory (October 23), set session.upload_progress.enabled to 0 in php.ini
- If you are running PHP 8.1 or older, upgrade to a supported version
* PHP 8.2 also reaches end of life on December 31, 2026. We recommend considering a move to PHP 8.3 or later.
We provide vulnerability impact assessments, emergency updates to fixed PHP releases, and upgrades and migrations from end-of-life PHP versions. If you are not sure whether your site is affected, or cannot reach the company that built it, please feel free to contact us.
Reference: PHP official website https://www.php.net/archive/2026.php