PHP: Critical Vulnerabilities CVE-2026-109618 / CVE-2026-109619

22/10/2026 - 11:36 Investigating

PHP: Critical Vulnerabilities CVE-2026-109618 / CVE-2026-109619

🔎 What happened?

The PHP Security Team published an advance notice regarding two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both rated with a CVSS v4.0 score of 9.2 (Critical).

Due to the severity of the vulnerabilities, emergency security updates are scheduled to be released today, 21 October 2026 at 14:00 UTC (15:00 in mainland Portugal).

For security reasons, technical details of the vulnerabilities, the affected PHP versions, and the corresponding fixed versions have not yet been disclosed. This information will be published by the PHP team at the same time as the updates.

The PHP Security Team recommends that all users and system administrators prepare to update as soon as the new versions become available.

PHP has also indicated that the release may be brought forward if details of either vulnerability become public or evidence of active exploitation is identified.

🔗 References:

⚠️ What is affected?

Following the release of the security updates on 21 October 2026, details of CVE-2026-109618 and CVE-2026-109619 were confirmed.

For the versions currently supported by the PHP project, fixes are available starting from the following versions:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

The vulnerabilities may affect PHP installations processing Web requests through different interfaces and environments, including:

  • PHP-FPM
  • Apache with mod_php
  • php-cgi
  • FrankenPHP
  • LiteSpeed / LSAPI

According to the technical information subsequently disclosed, Apache mod_php presents the highest-risk scenario. PHP-FPM, LiteSpeed/LSAPI and FrankenPHP are also affected under certain configurations.

The vulnerabilities may allow unauthenticated remote code execution, and it is therefore recommended that fixed versions be installed as soon as they become available for each platform.

Older PHP versions

PHP versions that have already reached the end of their official support period (End of Life – EOL) no longer receive regular updates directly from the PHP project.

However, in the context of these vulnerabilities, CloudLinux announced that it was preparing security fixes for all alt-php versions, from PHP 5.2 through PHP 8.5. cPanel also announced that it was preparing fixed packages from ea-php74 through ea-php85 via EasyApache 4.

These exceptional fixes make it possible to protect environments that still temporarily require older PHP versions, but they do not change the official support status of those versions.

Regardless of these vulnerabilities, we recommend that customers use, whenever possible, recent, stable and officially supported PHP versions, while also keeping applications, plugins, themes and other dependencies up to date and compatible.

Using a supported version provides access to regular security updates and reduces reliance on exceptional fixes provided by platform vendors.

Changing the PHP version in cPanel

In a Shared Web Hosting environment with cPanel, you can see how to set the PHP version in the video below:

You can find more details in the following article: cPanel – Change PHP Version

The use of PHP versions that have already reached their End of Life (EOL) should be avoided. Although some of these versions may receive exceptional fixes from the vendors of the distributions used on the servers, these updates may not be made available with the same priority or speed as updates for PHP versions that are currently supported.

Using a supported version provides access to regular security updates and reduces the risks associated with using older versions for which official maintenance is no longer available.

🧠 Technical impact

Both vulnerabilities allow Unauthenticated Remote Code Execution (RCE) and are rated with a CVSS v4.0 score of 9.2 (Critical).

CVE-2026-109618 results from a memory corruption condition associated with the handling of Out of Memory (OOM) errors.

Under certain conditions, PHP may interrupt the processing of a request while internal structures have not yet been fully initialised. During the shutdown of that request, these invalid structures may subsequently be interpreted as valid, resulting in memory corruption and, under conditions controlled by an attacker, remote code execution.

Several ways of triggering this condition have been identified, including specially crafted multipart requests capable of causing excessive memory consumption while the request is being processed. (GitHub)

CVE-2026-109619 is related to the incorrect preservation of global state between different requests processed by the same PHP worker.

Under certain circumstances, information belonging to one request may remain referenced after the corresponding memory has been released. A subsequent request processed by the same worker may reuse this invalid state before PHP completes the normal initialisation of the new request, resulting in a use-after-free condition.

Several exploitation paths have been confirmed, including the PHP Session Upload Progress mechanism, fatal errors and certain configuration diagnostics. Exploitation has been validated in both mod_php and PHP-FPM under specific scenarios. (GitHub)

The confirmed impact includes code execution with the privileges of the Web process, without requiring authentication or user interaction.

🛡️ Vulnerability mitigation

The definitive fix for these vulnerabilities is to update PHP to a version that includes the corresponding security patches.

While the new packages are not yet available for all versions and distributions, temporary measures may be applied to reduce the attack surface.

CloudLinux recommends, as a partial mitigation, disabling the PHP Session Upload Progress functionality:

session.upload_progress.enabled = 0

After making this change, the corresponding PHP services must be restarted, namely PHP-FPM, Apache or LSAPI, depending on the configuration in use.

This measure blocks one of the known exploitation vectors, but does not completely eliminate the vulnerabilities and therefore does not replace the installation of the security updates.

Additionally, CloudLinux has made rules available through Imunify360/WAF designed to identify and block known exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619.

These rules provide an additional layer of protection, but they also do not replace updating PHP.

🏗️ What we have done

Following the release of fixes by the different vendors, the WebTuga technical team updated the infrastructure managed by WebTuga during the evening of 21 October and the early hours of 22 October.

The different platforms used on WebTuga-managed servers within our infrastructure were checked and updated, including:

  • Shared Web Hosting servers with cPanel;
  • Dedicated cPanel servers for customers;
  • Servers running DirectAdmin;
  • Windows servers (Plesk);
  • Servers providing multiple PHP versions through CloudLinux;

CloudLinux has since completed the release of the fixed alt-php packages to the Stable repositories, covering PHP versions 5.2 through 8.5 on the main supported CloudLinux systems.

Fixed ea-php52 through ea-php85 packages used by cPanel/EasyApache 4 are also available.

It is important to note that, in these environments, security fixes may be applied through backports. As a result, the PHP version number displayed may not correspond to the versions published directly by the PHP project. In these cases, the presence of the fix is determined by the package provided by the vendor and its corresponding changelog.

Additionally, servers protected by Imunify360/WAF automatically received successive security rule updates designed to block known exploitation patterns.

We continue to monitor the release of any additional updates from the different vendors and to validate the servers across our infrastructure.

📅 Timeline

20/10/2026 – The PHP Security Team provides advance notice of two critical vulnerabilities and announces the preparation of an emergency security update.

20/10/2026 – The vulnerabilities are publicly identified as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

20/10/2026 – CloudLinux confirms that it is monitoring the situation and awaiting disclosure of the technical information and fixed versions.

21/10/2026 – The WebTuga technical team continues to monitor the incident and prepares to update potentially affected servers.

21/10/2026 – CloudLinux releases version 8.83 of the Imunify360 ModSecurity ruleset to the Stable channel, including a blocking rule for the known exploitation pattern associated with CVE-2026-109618 and CVE-2026-109619.

21/10/2026 – CloudLinux confirms that exploitation attempts matching the known pattern are already being observed and announces the preparation of additional heuristic rules.

21/10/2026 – Mitigation through Imunify360/WAF is automatically distributed to protected servers while awaiting the release of fixed PHP versions and the corresponding alt-php packages.

21/10/2026 – 15:00 – Scheduled time for the publication of the security updates, affected versions and technical details of the vulnerabilities.

21/10/2026 – 15:00 – The PHP project releases versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing CVE-2026-109618 and CVE-2026-109619.

21/10/2026 – 15:00 – Technical details of the vulnerabilities are disclosed, confirming the possibility of unauthenticated remote code execution.

21/10/2026 – CloudLinux confirms that it is preparing fixed packages for all alt-php versions, from PHP 5.2 through PHP 8.5, with availability expected within the following hours.

21/10/2026 – cPanel prepares the release of fixed ea-php74 through ea-php85 packages via EasyApache 4 v25.91.

21/10/2026 – Imunify360/WAF protection rules against known exploitation patterns remain active.

21/10/2026 – 20:55 – CloudLinux confirms the availability of fixed ea-php52 through ea-php85 packages in the Stable repositories for cPanel/EasyApache 4 environments.

22/10/2026 – 00:07 – CloudLinux completes the release of fixed alt-php packages to the Stable repositories for CloudLinux OS 7, 8 and 9, covering PHP 5.2 to 5.6, 7.0 to 7.4 and 8.0 to 8.5.

22/10/2026 – During the early hours – The WebTuga technical team updates and verifies the different PHP platforms across the infrastructure, including cPanel, CloudLinux, DirectAdmin and Windows servers.

22/10/2026 – 05:23 UTC – CloudLinux reports that native operating system PHP packages continue to be rolled out gradually. The fixed alt-php and ea-php packages are already available in the Stable repositories.

✅ Current status

🟢 Fixes available: Updates applied

Security fixes for CVE-2026-109618 and CVE-2026-109619 are available through the different vendors used across our infrastructure.

During the night of 21 to 22 October, the WebTuga technical team updated the servers and different PHP platforms under our management, including cPanel, CloudLinux, DirectAdmin and Windows environments.

We continue to monitor the infrastructure and verify additional or older systems that may require specific updates.

The additional protections provided through Imunify360/WAF also remain active.

WebTuga will continue to monitor any additional updates related to these vulnerabilities.

🧾 Conclusion

CVE-2026-109618 and CVE-2026-109619 are two critical PHP vulnerabilities that allow unauthenticated remote code execution. The PHP Security Team recommends immediately updating to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on the branch in use. There is no complete configuration-only mitigation, making the installation of the security updates essential. WebTuga has applied the security fixes made available by the relevant infrastructure vendors.

WebTuga will continue to monitor the situation and prioritise the application of any additional fixes or updates as soon as they become available.

  1. 22/10/2026 - 11:36
  2. 0 Updates

Translation