PHP Security Vulnerabilities 2026: Affected Versions & Fixes

If you manage a website or application that uses PHP, it is time to check the PHP version running on your server. On October 21, 2026, the PHP team released updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, these vulnerabilities can allow remote code execution without authentication. [1]

What to do first: Update to a patched release within your current PHP branch. The first releases containing the fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Earlier announcements stating that no patch was available are now outdated. [1]

What do these PHP vulnerabilities mean?

CVE-2026-109618 concerns how PHP handles out-of-memory conditions. When an operation is interrupted at an unsafe point, PHP may treat partially initialized internal data as valid. This can lead to memory corruption and remote code execution. In the demonstrated exploit, code runs with the privileges of the account running the web server's PHP process; this does not automatically grant root access. [2]

CVE-2026-109619 involves invalid internal state remaining in memory after a request ends and being used by a subsequent request handled by the same PHP worker. Exploitability depends on application operations, error conditions, and server configuration. Running an affected version does not mean that every request will result in a successful attack. [3]

Which PHP version should you update to?

For example, moving from PHP 8.3.35 to 8.4.26 does not fix these vulnerabilities. If you remain on the PHP 8.3 branch, choose version 8.3.36 or a later patched release. If your distribution has backported the fixes to a package retaining an older PHP version number, refer to your provider's package security advisory. PHP 8.1 and older branches no longer receive regular official updates, so confirm patch availability with your provider separately. [1]

Can websites without file upload features be affected?

Yes. The absence of an upload form does not provide protection on its own. The attack demonstrated against Apache mod_php can occur while PHP automatically processes an incoming request, before any application code runs. An application endpoint that saves uploaded files is therefore not required. [2]

The conditions differ for PHP-FPM. In the documented session-related attack path, state left behind after a fatal error during a suitable application operation must be used by a subsequent request. The session upload progress mechanism does not require the application to call session_start(). Checking only the login page or upload form is therefore insufficient to determine whether a site is safe. [3]

Is session.upload_progress.enabled = Off enough?

session.upload_progress.enabled = Off

This setting is a temporary mitigation that can block the confirmed session-related attack paths. It does not cover other paths or fully address both vulnerabilities. The configuration must take effect before request processing, and PHP workers must be restarted. Using ini_set() within the application or .user.ini with FPM is not a reliable alternative for this purpose. The permanent solution is a PHP update containing the complete fixes. [3]

What should website owners do?

First, check your hosting panel or ask your server administrator which PHP version your website actually uses. Do not rely solely on the output of php -v in the terminal: the command line and your website may use different PHP installations.

Back up your files and database before updating. Then update the relevant PHP packages, restart the running PHP services, and verify that the website is using the patched version. Finally, test essential workflows such as user login, form submissions, photo uploads, payments, and API operations.

You do not have to move from PHP 8.3 to 8.4 solely to obtain the security fixes. If you plan to switch branches, check compatibility in a test environment first. In PHP 8.4, some older usages generate deprecation notices, while certain invalid arguments can trigger exceptions. [4]

What risks could these vulnerabilities pose to real estate websites and CRM systems?

If you use a PHP-based real estate website or CRM, the impact of these vulnerabilities could extend beyond website downtime. If successfully exploited, they could allow unauthorized access to client contact details, inquiry and conversation notes, property owners’ information, and documents stored in the system, provided the application can access that data. Other possible consequences include changes to listing information, file deletion, or service disruption.

The extent of the risk depends on the server configuration and the data the application can access. For example, a website that only publishes property listings does not hold the same amount of data as a CRM that also manages client records and private documents. Using an affected PHP version does not mean your information has been compromised; however, the security update should not be delayed.

Does this announcement mean my website has been hacked?

No. A security advisory or the detection of an affected version is not, by itself, evidence of a successful attack. However, updating does not prove that a previous compromise has not occurred. If you discover suspicious file changes or unexpected activity, an incident investigation is needed alongside the update.

If you are unsure which PHP version your website uses or how an update might affect your application, contact Alanya Digital Solutions for an assessment of your existing infrastructure.

Official sources

1. PHP team's security advisory dated October 21, 2026
2. CVE-2026-109618: RCE via OOM corruption
3. CVE-2026-109619: RCE via stale global state
4. PHP 8.4 migration guide: backward incompatible changes and deprecated features