On 21 October 2026, PHP published an official security advisory and urgent updates. If your business runs PHP applications, check their runtime versions and identify who maintains each installation.
This guide was reviewed on 23 October 2026. Apply the security update first, then address the obstacles that make routine maintenance difficult.
What happened
CVE-2026-109618 concerns memory corruption during out-of-memory error handling. CVE-2026-109619 concerns stale internal state between requests. Both can enable unauthenticated remote code execution.
The issues affect the PHP runtime. Updating only your CMS or plugins does not replace the server patch, as the WordPress announcement explains.
How to fix the issues
1. Find every PHP installation
List websites, stores, portals, APIs, containers and internal tools. Record the provider, owner, version and Internet exposure. Start with public systems.
On a self-managed server, php -v reports the command-line version. The website may use a different version: also check the PHP-FPM pool, Apache module or container image serving requests. Avoid publishing an Internet-accessible phpinfo() file.
For managed hosting, request patch confirmation for each site. In WordPress, check Tools → Site Health → Info → Server, as described in its official announcement.
2. Confirm the correct update
The PHP advisory lists these fixed releases:
| Branch | Fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Install the listed release or a later release in the same branch containing the fixes. Where a distribution backports patches, check its advisory for the full package revision and coverage of both CVEs. The base version alone is insufficient evidence.
PHP 8.1 and older are outside upstream support. Check whether your vendor provides a maintained fix and plan migration to a supported branch.
3. Prepare recovery and check compatibility
Keep a verified backup of data, files and configuration with restricted access. Assign recovery ownership and procedures. Test essential workflows such as login, orders, payments, forms and integrations in a test environment.
Prepare urgently without extending exposure. If immediate patching is impossible, CERT-EU recommends considering isolation of public applications. A maintenance page handled by the vulnerable PHP application does not isolate the runtime.
4. Update every affected runtime
Use corrected distribution packages, your hosting control panel or a rebuilt, updated container image. Include required extensions and every replica serving traffic. There is no universal update command: the operating system, repository and installed branch determine the procedure.
Restart or replace all PHP processes still loading the old runtime. Updating files on disk alone may leave the running service unchanged.
5. Verify the live service
Confirm the patched version or package revision in the actual web runtime. Repeat critical workflows and inspect HTTP errors, PHP logs and job queues. Record the installed package, date and verification result for each server or container.
If incompatibility requires rollback, keep the service isolated rather than exposing the vulnerable runtime again.
6. Look for signs of compromise
A patch does not undo an earlier intrusion. Check unexpected files, administrative access, processes and outbound connections. If evidence suggests compromise, activate incident response, preserve evidence and rotate affected credentials from a trusted environment.
Temporary settings and WAF filters cannot replace the update. The PHP advisory describes their limitations; assess operational effects before changing memory or runtime settings.
When patching becomes a legacy application project
If a routine runtime upgrade breaks the application, inventory dependencies, add tests for essential workflows and plan phased migration with acceptance and rollback criteria.
Codefuente provides application modernization: runtime and framework upgrades, refactoring, data and integration migrations and ongoing maintenance. This reduces technical debt and makes future patching easier; it cannot guarantee the absence of new vulnerabilities.
Our cybersecurity service complements this work with access reviews, system protection and backup and recovery as an add-on, including isolation, retention and restoration tests.
Tell us which application needs updating so we can plan around its dependencies and business impact.