In brief
Two PHP vulnerabilities can allow unauthenticated remote code execution under affected conditions. A practical response starts with runtime ownership and vendor patch evidence, not just updating website plugins.
What PHP announced on 21 October
PHP released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both official advisories carry a CVSS v4 score of 9.2 and describe potential unauthenticated remote code execution. This is a runtime security issue, not simply a reason to update a website theme.
The upstream fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These are separate release branches: use the patched release for your supported branch, or a later appropriate security release. Distribution and long-term-support vendors may supply backported fixes, so verify the vendor’s package advisory rather than judging protection from a shortened version string alone.
Broad urgency does not mean identical exposure
PHP’s announcement urges updates across installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The technical details still matter.
CVE-2026-109618 concerns corrupted request state following an out-of-memory failure. The advisory describes demonstrated remote code execution against mod_php, including a path before application code runs. For this particular issue, it describes FPM as susceptible based on source analysis, without a complete demonstrated FPM exploit.
CVE-2026-109619 concerns stale request-owned state reused by a worker. Its advisory reports validated session-lifecycle remote code execution against both mod_php and FPM; the relevant paths depend on configuration and execution conditions. Do not turn the first advisory’s FPM qualification into a claim that FPM is safe overall.
These findings justify urgent patching. They do not establish that every PHP website is exploitable in the same way, or that your website has been compromised.
A practical response for website owners
The following is MIRA CODE’s operational checklist, not a substitute for your hosting provider’s deployment procedure.
1. Identify the owner of the runtime. Ask who maintains PHP for each production site, API and background service: your host, development team or infrastructure provider. Include every replica or container, not only the main server.
2. Ask for patch evidence. Request the active web-serving PHP branch, build or package revision, deployment method, and the vendor notice confirming that both CVEs are fixed. A command-line PHP version may differ from the runtime serving requests.
3. Prepare a controlled deployment. Check a recent restorable backup and a recovery plan. Test the security update promptly in a representative staging environment, including login, forms, file uploads and important integrations. Do not let a broad redesign or optional feature upgrade delay the security response.
4. Replace what is actually running. Apply the approved runtime or vendor package update, or rebuild and redeploy the container image. Restart or recycle affected services and workers according to the deployment procedure so an old process is not left serving requests.
5. Verify after deployment. Record the running version or vendor package revision on every serving instance. Repeat the essential application checks and monitor errors. A successful package installation or image build alone is not proof that production is using it.
What does not count as a complete fix
Updating JavaScript dependencies with npm does not patch PHP. A CMS or plugin update is also not evidence that the underlying runtime has changed.
PHP states that configuration mitigations are incomplete. If an immediate update is blocked, ask the responsible administrator to apply the official, environment-specific interim guidance while arranging the patch. Do not copy memory-limit changes into production without considering capacity and availability consequences.
For PHP 8.1 or older, verify supported vendor backports or plan a supported-version migration; routine upstream support has ended. Treat a migration as a tested deployment, not an assumption that a major version switch will be compatible.
Keep the handover evidence
A useful closure note is short: which systems were checked, who deployed the fix, which build is now running, when workers were replaced, and which business functions were tested. Keep unresolved instances visible until verified.
This is a practical consideration for web development and custom software projects: runtime ownership and maintenance responsibilities should be clear alongside application delivery. It is not a claim that any MIRA CODE customer is affected, and patching should not be presented as a guarantee against every security risk.
Official facts checked on 22 October 2026. Follow subsequent PHP and vendor notices if their guidance changes.
