A routine PHP security update can feel like something to schedule after the next deploy. The October 2026 PHP advisory deserves a faster response. CERT-EU reports two critical vulnerabilities that can allow an unauthenticated attacker to execute code through a web-facing PHP runtime. Public proof-of-concept discussion had begun when the advisory was updated, so exposed servers should be checked promptly.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU assigns each a CVSS score of 9.2. This guide summarizes the affected branches and a practical response based on the CERT-EU advisory.
Check whether your PHP runtime is affected
The PHP project released fixed versions on October 21, 2026:
| Branch | Affected versions | Fixed release |
|---|---|---|
| PHP 8.5 | Earlier than 8.5.12 | 8.5.12 |
| PHP 8.4 | Earlier than 8.4.27 | 8.4.27 |
| PHP 8.3 | Earlier than 8.3.36 | 8.3.36 |
| PHP 8.2 | Earlier than 8.2.35 | 8.2.35 |
| PHP 8.1 and older | End-of-life branches | Check vendor backports or upgrade |
Check the PHP process that serves requests, since the command-line PHP version may differ from PHP-FPM or Apache's PHP module:
php -v
php-fpm8.4 -v
systemctl list-units 'php*-fpm.service'
Use the FPM binary and service name installed on your host. If you run Apache with mod_php, PHP-CGI, FrankenPHP, or LiteSpeed, verify the version in that runtime's own configuration and service. Containerized applications need the same check against the image actually deployed. Linux distributions may backport a fix without changing the upstream version string, so check the package changelog or security status from your distribution too.
Patch the runtime and restart it
Upgrade to the fixed release for your branch using packages from your operating system vendor or a trusted PHP distribution. On Debian or Ubuntu, for example, update the package index and review available PHP updates before upgrading the packages used by your application:
sudo apt update
apt list --upgradable | grep -E '^php|php[0-9]'
Package names differ between distributions and PHP versions, so confirm the target packages before applying the upgrade. If you use containers, rebuild from an updated, trusted base image and deploy the new image. Updating a host package does not patch an old PHP container.
Restart every PHP worker or web service that loads the runtime. For PHP-FPM, use the versioned service on your system, then verify both the package and the service state:
sudo systemctl restart php8.4-fpm
sudo systemctl --no-pager --full status php8.4-fpm
Replace 8.4 with your installed branch. Check application health, error logs, and the version reported by the serving runtime after restart. Roll out across all hosts, worker pools, staging systems, and autoscaling images. An updated first node does not protect requests routed to an older peer.
Reduce exposure while patching
CERT-EU is clear that only an update fully fixes these flaws. If patching cannot happen immediately, isolate internet-facing PHP applications from public access until you can patch and verify them. Temporary settings can reduce specific attack paths, but they do not remove all risk.
For CVE-2026-109618, the advisory describes setting memory_limit=-1 through a setting applications cannot override, such as php_admin_value in an FPM pool. This removes the controllable memory-limit failure path, while an underlying allocation failure can still reach the vulnerable code. Check that no pool, directory, or application setting restores a finite limit. Because unlimited PHP memory can affect availability, pair this temporary measure with a container or cgroup memory boundary and monitoring. Avoid RLIMIT_AS and RLIMIT_DATA, which the advisory warns can trigger vulnerable allocation behavior.
The advisory also recommends a low post_max_size: 8M if uploads are unnecessary, or 32M when uploads are required. Keep upload_max_filesize lower than post_max_size. For an FPM pool, a temporary example might be:
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 7M
Use the 32M post limit and a lower upload limit if your service needs uploads. Also consider web-server or proxy limits for decoded request size, input fields, multipart parts, headers, and nesting depth. Those controls should cover requests without a usable Content-Length too.
For CVE-2026-109619, CERT-EU recommends disabling session upload progress before request parsing and restarting every worker. In an FPM pool, settings may look like this:
php_admin_value[session.upload_progress.enabled] = 0
; PHP 8.5 only, blocks the confirmed fatal-backtrace path
php_admin_value[fatal_error_backtraces] = 0
The second setting applies to PHP 8.5 and blocks only the confirmed fatal-backtrace path. Other temporary measures in the advisory include fixing attacker-reachable fatal errors and timeouts. Do not rely on application-level ini_set() or .user.ini for the upload-progress setting, since those take effect too late for the described request path. Restart all workers after changing server-level configuration.
Close the incident loop
Record which versions were running, when each host or image was patched, and how you verified the serving runtime. Review web, PHP-FPM, and infrastructure logs for unusual requests or worker crashes during the exposure period. If you find signs of compromise, preserve relevant logs and follow your incident-response process before rebuilding affected systems.
The key operational lesson is to inventory every PHP runtime, including containers and embedded copies, then patch and restart all of them. Configuration mitigations can buy time while you work, but the fixed PHP release is the action that closes the vulnerability.