If your website runs PHP, ask your hosting provider or development team to confirm its security update today. CISA’s October 21 alert calls for immediate patching of two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also called php2shell. These flaws can allow someone without a login to run code on an affected server.
The PHP runtime is the server software that executes your website’s PHP code. Updating website content, themes or plugins does not confirm that this underlying software has been patched.
Key Takeaways
- Prioritize internet-facing PHP systems and identify PHP bundled inside other software.
- The fixed stable releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; vendor backports require vendor confirmation.
- CISA had not observed exploitation at publication. That dated statement does not establish that attacks cannot occur.
- Get evidence of deployment, worker restart and application checks before closing the update.
Which PHP Versions Need Attention?
Both official PHP advisories list the following branch-specific affected and patched versions:
PHP 8.2: releases before 8.2.35 → update to 8.2.35.
PHP 8.3: releases before 8.3.36 → update to 8.3.36.
PHP 8.4: releases before 8.4.27 → update to 8.4.27.
PHP 8.5: releases before 8.5.12 → update to 8.5.12.
These are the minimum fixed stable versions for the two CVEs in this alert. Later releases may include additional security fixes. Follow current PHP or package-vendor guidance and your platform’s compatibility requirements.
PHP 8.1 and earlier no longer receive normal PHP-project updates. PHP has supplied minimal source backports for 7.4, 8.0 and 8.1, and some distribution or LTS vendors provide fixes. Do not assume an older installation is covered: obtain the vendor’s advisory and exact patched package revision, or move to a supported branch. PHP 8.6.0 RC4 also includes fixes, but PHP explicitly says this testing release is unsuitable for production.
What Do the Two Vulnerabilities Do?
CVE-2026-109618: Out-of-Memory Corruption
An allocation failure can interrupt PHP while request data is incompletely initialized. Later cleanup can use that invalid data and lead to remote code execution. The advisory demonstrates a particularly serious path in Apache mod_php before application code runs; it also identifies susceptibility in other server interfaces.
CVE-2026-109619: Stale Global State
A worker can retain references to memory belonging to a finished request. A later request reaching the same worker may use that stale state. The advisory confirms remote code execution paths in mod_php and PHP-FPM, with conditions that vary by application and configuration.
Both advisories rate severity Critical, CVSS v4.0 9.2. A demonstrated exploit is evidence of technical feasibility; it is not itself evidence of exploitation against your website. PHP’s warning covers installations serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed.
What Should Your Team Do Now?
- Inventory the runtime. Ask who owns PHP updates for each website, server, container and bundled application. Include less-visible systems, not just the main marketing site.
- Apply the appropriate fix. Prioritize internet-facing systems. For managed hosting or distribution packages, ask for the provider’s advisory and patched package evidence rather than relying only on a familiar version label.
- Restart and verify. Have the operator restart or replace affected PHP workers and confirm the runtime serving web requests is patched on every instance. Rebuild and redeploy containers where needed. A command-line version check alone may describe a different runtime.
- Check the business journey. Test the homepage, login, forms, checkout and important integrations as applicable. Record the deployed package, affected systems, completion time and person responsible.
- Keep monitoring. CISA calls out PHP workers spawning shells or downloading tools as suspicious activity. Escalate findings to the security team; a completed update does not establish that an earlier compromise has been ruled out.
If You Cannot Patch Immediately
CISA recommends taking PHP-based systems offline until patched or updated when immediate updating is not possible, including continued use of unsupported PHP 8.1 or earlier. Coordinate that action with the hosting and business owners.
PHP’s configuration measures reduce particular attack paths but do not provide a complete fix. CISA says a web application firewall may offer some protection. Neither should be treated as a substitute for the update. Have the server operator follow the official PHP instructions rather than applying isolated settings without understanding their effects.
How Living Proof Creative Can Help With Your Website Maintenance Needs
Our recommendation is to close the loop with evidence: which systems were covered, which fix was deployed, whether workers restarted and which business functions passed checks. “The website is updated” leaves too much room for misunderstanding.
Need help coordinating website maintenance? Tell us which platform and hosting provider you use, who handles server updates and what patch confirmation you have received.
Frequently Asked Questions
Does Updating WordPress or Magento Fix This?
Not necessarily. Updating WordPress or Magento does not confirm that the server’s PHP runtime was patched. Ask your host or developer to verify the PHP package and running workers separately. For Magento sites, explore our Magento support and maintenance services.
Does Magento 2.4.8-p5 Automatically Include the October Fix?
Yes, some distribution and long-term support vendors provide backported fixes. An older version number alone does not show whether those fixes are installed. Request the exact package revision and the vendor’s security notice confirming coverage for both CVEs.
Official Sources
CISA alert — immediate response and exploitation status at publication.
PHP security announcement — scope, releases, legacy branches and incomplete mitigations.
PHP advisory: CVE-2026-109618 — affected/fixed versions and OOM analysis.
PHP advisory: CVE-2026-109619 — affected/fixed versions and stale-state analysis.
