[Updated] Urgent PHP Fix: Two Critical Vulnerabilities, Update Your Site

On 21 October, PHP released a security update that fixes two critical vulnerabilities. In this article you will learn which versions received a fix, how to check the PHP version of your site and what to do if you use an unsupported version.

This article has been updated with the official information published together with the fix. All changes are listed in the Updates section at the end of the article.

What happened?

On 20 October, the PHP team announced an upcoming security update on php.net. On 21 October at 14:00 UTC (17:00 Bulgarian time), it was released together with the details.

Both vulnerabilities are in PHP itself, not in a specific platform or plugin:

• CVE-2026-109618. When PHP runs out of memory while handling a request, it can stop halfway, while some internal data is only partially filled in. The cleanup after the request then treats this data as valid. With a specially crafted request, this can lead to code execution.
• CVE-2026-109619. After a request ends, a PHP process can keep information that points to memory that has already been freed. If the next request is handled by the same process, it can use this stale information, which can also lead to code execution.

All the ways PHP serves websites are affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to the PHP team, the risk is highest with mod_php, because there the attack can start before the site's own code even runs.

Does this apply to my site?

PHP is the language behind many of the most popular website platforms. If you use one of them, your site most likely runs on PHP, even if you have never had to deal with it:

• Websites and blogs: WordPress, Joomla, Drupal
• Online stores: WooCommerce, Magento, PrestaShop, OpenCart
• Forums and internal systems: phpBB, Moodle, Nextcloud

Because the vulnerabilities are in PHP itself, they affect every site on a vulnerable version, regardless of the platform. So besides keeping your platform up to date, it is important to keep your PHP version current too.

Which PHP versions received a fix?

All versions that PHP supports received fixes. Versions whose support has ended have no official update.

Given the severity of the vulnerabilities, the PHP team also published minimal source-code fixes for 7.4, 8.0 and 8.1. They are meant for people who build PHP themselves. This is not an official release and does not make these versions supported.

The support dates for each version are published on php.net.

What should you do?

1. Check which PHP version your site uses

In WordPress: go to Tools → Site Health → Info → Server and look at the PHP version row.

In your hosting control panel: the version is shown in the PHP management section. This is the easiest way if you use another platform.

2. If you are on PHP 8.2, 8.3, 8.4 or 8.5

On shared hosting, we take care of updating PHP. You do not need to do anything.

On our unmanaged VPS and dedicated servers, updating PHP is your responsibility. Do it yourself or through your server administrator:

1. Install the updated PHP packages from the source you use. Linux distributions (Debian, Ubuntu, AlmaLinux, etc.) received the fixes in advance and release their own packages with their own version numbers. Follow the security bulletins of your distribution.
2. Restart PHP-FPM and the web server so that all old PHP processes stop.
3. Check with the php -v command that the new version is running.

If you cannot update right away, the PHP team describes temporary measures. They reduce the risk but do not remove it. Add the following settings to php.ini and restart PHP-FPM and the web server:

; Disables file upload progress tracking
session.upload_progress.enabled = 0

; PHP 8.5 only
fatal_error_backtraces = 0

; 8M for sites without file uploads, 32M for sites with uploads
post_max_size = 8M

The full list of measures is in the PHP security advisory. Update as soon as you can.

3. If you are on PHP 8.1 or older

There is no official update for these versions, so it is a good idea to move to a supported version:

1. Make a backup of your site's files and database.
2. Update your platform, plugins, modules and theme to their latest versions. This way your site will keep working smoothly with the new PHP version.
3. Change the PHP version from your hosting control panel. We recommend PHP 8.4 or 8.5. If a plugin does not support them, choose at least 8.3.
4. Check your site: the home page, forms, cart and checkout (if you run an online store) and the admin area.
5. If something does not work as expected, temporarily switch back to the previous version and contact your site developer.

Where to follow official information?

• PHP security advisory of 21.10.2026: description of the vulnerabilities, the fixed versions and the temporary measures.
• Supported PHP versions: how long each version receives security fixes.

Updates

21.10.2026, 04:00 (Bulgarian time): Article published. The update had not been released yet.

21.10.2026, 12:26 (Bulgarian time): Imunify360 has applied a ModSecurity patch to limit exploitation of this vulnerability.

21.10.2026, 19:30 (Bulgarian time): PHP released the fix at 17:00 Bulgarian time. Added the fixed versions, a description of the vulnerabilities and temporary measures for unmanaged VPS and dedicated servers.