Last Updated: 23 October 2026

 

Keeping a server secure requires continuous maintenance, regular monitoring, and timely software updates. Even a well-configured server can become vulnerable when critical security issues are discovered in the software it runs. On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow an unauthenticated attacker to execute malicious code remotely on an affected server. Both have a CVSS v4.0 severity score of 9.2.

 

Since PHP is widely used by websites, content management systems, and web applications, these vulnerabilities require immediate attention from server administrators and hosting providers. At ServerManagement.LK, we recognize that keeping server infrastructure secure is an ongoing responsibility. Server owners should identify affected PHP installations, apply the appropriate security updates, and verify that their systems are protected.

 

Understanding the PHP Vulnerabilities

Both vulnerabilities are related to the way PHP handles memory and internal request data. Under certain conditions, these issues could allow an attacker to execute code on a vulnerable server without authenticating first.

 

CVE-2026-109618: Out-of-Memory Handling

This vulnerability occurs when PHP encounters an out-of-memory (OOM) condition during request processing. In certain circumstances, PHP may stop processing a request while internal data is only partially initialized. During cleanup, the runtime may incorrectly handle this incomplete data, resulting in memory corruption. An attacker may be able to exploit this behavior to execute malicious code on the affected server.

 

CVE-2026-109619: Stale Internal State

This vulnerability involves internal request data that remains accessible after the memory associated with it has been released. A subsequent request handled by the same PHP worker may use this stale state before it has been properly reset. Under certain conditions, this can also lead to remote code execution. These issues affect the PHP runtime itself. Updating a website's content management system, themes, or plugins alone will not fix a vulnerable PHP installation.

 

Which Servers and Applications Are at Risk?

Any server running an affected PHP installation that processes web requests should be assessed. Potentially affected environments include:

  • Linux servers running PHP-based websites and applications.
  • Servers managed through cPanel & WHM or Plesk.
  • VPS and dedicated hosting environments.
  • WordPress websites and other content management systems.
  • Applications built with PHP frameworks such as Laravel.
  • Servers using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.
  • Applications and third-party products that include their own PHP runtime.

The PHP development team considers Apache with mod_php a particularly high-risk configuration. However, administrators should not assume that other PHP handlers or hosting platforms are safe without checking the relevant software and security updates. Internet-facing systems should receive priority during the review. A server may continue to operate normally while still running vulnerable software.

 

Fixed PHP Versions

The PHP development team has released security fixes for the following PHP branches:

  • PHP 8.5 — version 8.5.12
  • PHP 8.4 — version 8.4.27
  • PHP 8.3 — version 8.3.36
  • PHP 8.2 — version 8.2.35

These releases address CVE-2026-109618 and CVE-2026-109619. Earlier releases within the affected branches should be updated to the appropriate fixed versions. PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. Some vendors may provide backported fixes for selected older releases, so administrators should check the relevant vendor guidance before determining whether a particular installation is protected.

 

The PHP version number alone may not always confirm the security status of a vendor-maintained package. In some environments, a vendor may apply a security fix through an updated package build without changing the displayed PHP version. For the complete technical details, refer to the  official PHP security advisory.

 

What Should Server Administrators Do?

Server administrators should take a structured approach to identifying vulnerable systems, applying updates, and checking for signs of compromise.

 

1. Identify All PHP Installations

Start by identifying the PHP versions installed across your server infrastructure. Check individual websites, subdomains, background services, application workers, containers, and other software that may include PHP. A single server can run multiple PHP versions simultaneously. Priorities systems that accept requests from the internet, but do not overlook internal applications or services that may be exposed through other systems.

 

2. Apply the Appropriate Security Updates

Update affected PHP installations to the relevant fixed releases or install the appropriate security patches supplied by the operating system or software vendor. If your server uses a hosting control panel, verify that its PHP packages and relevant control panel components are also updated. After applying updates, restart affected services or reload the relevant workers when required. Confirm that the running applications are using the patched runtime rather than an older process that remains active.

 

3. Review Your Server Configuration

Check which PHP handler is used by each application and review the configuration of internet-facing services. If immediate patching is not possible, consult the temporary mitigation guidance provided by the PHP development team. Such measures may reduce exposure to particular attack paths, but they do not replace installing the proper security updates. If a vulnerable service cannot be updated or adequately mitigated, assess whether it should be isolated or taken offline until it can be secured.

 

4. Monitor Server Activity

Security monitoring plays an important role in identifying suspicious behavior and responding to potential incidents. Review relevant system logs, web server access logs, PHP error logs, authentication records, and process activity. Look for unexpected processes, suspicious requests, unauthorized file changes, or unusual outbound connections. Monitoring can help identify indicators of compromise, but the absence of suspicious activity does not prove that a server has not been affected.

 

5. Check for Signs of Compromise

If a server may have been exposed before the security update was applied, investigate whether an attacker gained access. Check for unfamiliar files, unexpected scheduled tasks, unauthorized accounts, modified application code, and other indicators of persistence. If compromise is suspected, follow an appropriate incident response process. Depending on the severity of the incident, this may require isolating the server, preserving evidence, restoring from a known-good backup, and reviewing credentials. Installing a security patch does not automatically remove malicious changes that may already exist.

 

6. Maintain Reliable Backups

Keep regular backups of website data, databases, application files, and important server configurations. Verify that backups are usable and that recovery procedures are documented. A tested backup can be valuable when recovering from a security incident or an unexpected problem during maintenance. Backups should complement security updates and monitoring, not replace them.

 

Considerations for cPanel, Plesk, and Linux Servers

The remediation process may differ according to the operating system, hosting control panel, PHP package source, and server configuration. For cPanel and Plesk environments, administrators should follow the official security advisories and confirm that both the relevant PHP packages and control panel components have been updated. For Linux servers managed without a hosting control panel, review the operating system repositories and the source from which PHP was installed.

 

Custom repositories, manually compiled PHP installations, and container images may require separate attention. Do not rely solely on a standard system update or a PHP version selected in a website control panel as proof that every affected component has been patched. The correct approach is to identify the actual software in use, apply the applicable vendor fix, and verify the result.

 

How Server Management Helps Improve Security

Maintaining secure server infrastructure involves much more than installing software updates once. Servers require ongoing attention to patch management, system configuration, backups, monitoring, and performance. ServerManagement.LK provides server management services covering cPanel, Plesk, and Linux environments. Depending on the selected service plan, server management can include day-to-day maintenance, backup management, performance optimization, technical support, and server uptime monitoring.

 

A structured server management process helps administrators identify maintenance requirements, respond to issues, and keep critical server components under review. If your organization operates a VPS, dedicated server, or hosting environment and needs assistance with server maintenance, security updates, or ongoing monitoring, visit ServerManagement.LK to explore the available services.

 

For existing managed server customers, contact your service team to discuss the applicable security review and remediation requirements. The specific work required will depend on your server environment and management plan.

 

Final Recommendations

CVE-2026-109618 and CVE-2026-109619 highlight the importance of maintaining secure and up-to-date PHP installations. Server owners and administrators should identify PHP-based services across their infrastructure, apply the appropriate security updates, and investigate any potential signs of compromise.

 

A reliable security approach includes regular patch management, appropriate monitoring, tested backups, and a clear incident response process. These practices help reduce the risks associated with vulnerable software and support the long-term reliability of server infrastructure. Do not assume that a server is secure simply because it is online and operating normally. Review the relevant software, follow official security guidance, and verify that the necessary fixes have been applied.

 

More Information

For official vulnerability details and platform-specific remediation instructions, refer to the following resources: