PHP RCE vulnerability, October 2026: how to fix it

On 21 October 2026 the PHP project shipped emergency security updates for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in, in some setups before any of your own code runs. If a website you are responsible for runs on PHP, including WordPress, act on this today. Here is how to fix it: which version to update to, how to check what your site is really running, and how to patch PHP on Linux, Windows, cPanel and WordPress hosting.

What is the October 2026 PHP vulnerability?

The PHP security team published a security advisory on php.net covering two vulnerabilities, both rated critical and both allowing unauthenticated remote code execution: someone on the internet can make your server run their code without needing an account. It applies to every PHP installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest risk, with a demonstrated exploit in which a single request triggers the attack before any application code runs.

CVE-2026-109618: RCE via out-of-memory corruption

If PHP runs out of memory at the wrong moment, it can be interrupted while internal request data is only partly set up. The cleanup that follows can then treat that half-built data as valid. Details are in GHSA-w8hw-w9fx-j79w.

CVE-2026-109619: RCE via stale global state

Some internal state that belongs to one request can outlive the memory behind it. A later request handled by the same worker process may use that stale state before normal initialisation resets it. Details are in GHSA-6wmf-4rv5-p3rp.

Which PHP versions are vulnerable, and which are patched

Every release before the ones below is affected. If a security scanner has flagged your server as running, say, PHP 8.3.31 or 8.2.31, that version is vulnerable to both CVEs unless your vendor has backported the fix (see the next section).

• PHP 8.5: patched in 8.5.12
• PHP 8.4: patched in 8.4.27
• PHP 8.3: patched in 8.3.36
• PHP 8.2: patched in 8.2.35. PHP 8.2 reaches end of life on 31 December 2026 and gets no security fixes after that, so plan the move to 8.3 or later now.
• PHP 8.6 release candidates: 8.6.0 RC4 carries the fix. It is a test build and not for production.
• PHP 8.1, 8.0 and 7.4: no longer supported, so there is no official release. Because of the severity, the PHP team published minimal source patches for people building from source, and some distributions and LTS vendors ship their own patched packages.

Source and Windows builds are on the php.net downloads page. Linux distributions received the patches in advance, so on a managed server the normal package update is usually the right route.

How to check your PHP version

This is where most "we updated" claims go wrong. A server often has more than one PHP on it, and the one you check is not necessarily the one answering web requests. Always confirm the version your website is served by, not just the one on the command line.

Check the PHP version of a website

The most reliable check is a temporary phpinfo() page uploaded to the site: it shows the exact version and the server API (FPM, Apache module, CGI) actually handling requests. Delete it as soon as you have read it. Some servers also announce their version in an X-Powered-By response header, which is what most security scanners read, though many hide it.

Check the PHP version in WordPress

In the WordPress dashboard go to Tools, then Site Health, then the Info tab, and open the Server section. It lists the PHP version the site is running on. Updating WordPress itself does not change it: the PHP version is set by your server or hosting account.

Check the PHP version in cPanel or Plesk

In cPanel, open MultiPHP Manager or Select PHP Version, which shows the version assigned to each domain. In Plesk, open the domain and look at PHP Settings. These panels choose between builds your host provides; whether those builds are patched is up to the host.

Check the PHP version on Linux, Ubuntu or Windows

In a terminal or command prompt, php -v prints the command-line version. On Linux, php-fpm8.3 -v (with your version number) or apache2ctl -M checks the web side. On Windows with IIS, the PHP Manager or the php-cgi.exe path in the handler mapping tells you which install IIS is using.

Distribution packages from Debian, Ubuntu, RHEL and similar often backport security fixes without changing the upstream version number. A version string older than the patched releases does not by itself mean you are exposed; check the package changelog or your vendor’s notice for CVE-2026-109618 and CVE-2026-109619.

How to fix the PHP vulnerability: update to the patched version

The fix is the update. There is no setting that fully closes either hole, so whichever platform you are on, the goal is the same: get the patched PHP running behind your website, then restart it.

Fix it on Linux: Ubuntu, Debian, RHEL

Run sudo apt update and then sudo apt upgrade, which installs your distribution’s patched PHP packages (the same applies if you use the ondrej/php repository). On RHEL, AlmaLinux or Rocky, sudo dnf upgrade does the same. Then restart PHP: for example sudo systemctl restart php8.3-fpm, or apache2 if PHP runs as an Apache module.

Fix it in cPanel, Plesk or WordPress hosting

On shared and managed WordPress hosting you usually cannot install PHP yourself. Pick the newest supported version in MultiPHP Manager, Select PHP Version or Plesk’s PHP Settings, and ask the host to confirm their builds include the October 2026 fixes. If your site is on PHP 8.1 or older, this is the moment to move it to 8.3 or later; test the site afterwards, as old plugins sometimes break.

Fix it on Windows

Download the patched build for your branch from the Windows section of php.net, matching the thread-safe or non-thread-safe variant you already use, and replace the PHP folder, keeping your php.ini. Then restart IIS (iisreset) or the Apache service.

Whatever the platform, restart afterwards. PHP-FPM workers and Apache keep the old code in memory until they restart, so check the version again from the website side once you have.

PHP RCE mitigation if you cannot update today

The advisory lists temporary measures. The PHP team is explicit that they reduce exposure to specific known attack paths and do not make an installation safe; only the patch does. They also only work if applied at the server level, before request parsing, so php.ini, the FPM pool or the Apache configuration, not ini_set() in your code or a .user.ini file.

Against CVE-2026-109618

• Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache config, and check nothing puts a finite limit back.
• Set a low post_max_size: 8M if the site takes no file uploads, 32M if it does, with upload_max_filesize below it. Also enforce request size limits at the web server or proxy.
• Use a container or cgroup memory limit as the safety net. Do not use RLIMIT_AS or RLIMIT_DATA instead: those can cause the very allocation failure the bug depends on.

Against CVE-2026-109619

• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
• Remove invalid or deprecated per-request settings that emit warnings before initialisation. Hiding the warnings with error_reporting, display_errors or @ does not help.
• Fix fatal errors and timeouts an attacker can trigger, including in upload and import handling.

How to fix PHP vulnerabilities like this in future

This will not be the last PHP security release. The sites that patch the same day tend to have the same few habits in place before the news breaks:

• Stay on a supported branch. Once a version reaches end of life, the next critical bug has no official fix at all, which is the position PHP 8.1 and older users are in today.
• Know where security news arrives. The php.net news feed and your Linux distribution’s security notices announce fixes the day they ship.
• Let the system install security updates. On Ubuntu and Debian, unattended-upgrades applies security packages automatically; on RHEL-family systems, dnf-automatic does the same. Your PHP processes still need restarting afterwards.
• Know which PHP serves each site, written down, so an update does not stop at the command-line copy while the website keeps running the old one.
• Turn off version disclosure. Setting expose_php = Off in php.ini removes the X-Powered-By header that tells scanners and attackers your exact version. It fixes the "PHP version disclosure" finding in security reports, but it hides the version rather than patching anything.

Need a hand with it?

If you run a PHP site and would rather not do this yourself, we can do it for you: confirm which PHP is actually serving your site, apply the update or your vendor’s patched package, restart the services, and check the result from the web side. If an update is not possible straight away, we can apply the interim settings above and tell you plainly what they do and do not cover. Email info@pdftolinks.com with your hosting type (shared, VPS or dedicated, and the control panel if there is one) and the PHP version you think you are on.

Frequently asked questions

Try it

Our PDF link extractor runs entirely in your browser — the file is never uploaded. More posts.