Two critical vulnerabilities in PHP can allow an attacker to execute code on a server without authenticating. The problem has to do with the engine used by many WordPress sites, online stores, and business applications. Patches were released today at 3:30 pm for maintained branches of the language. Administrators and hosts are asked to install them quickly: temporary setup is not enough to eliminate the risk.
Possible attacks before the site is even up and running.
PHP works behind the scenes to generate pages, process forms, or communicate with databases. Therefore, a vulnerability in this engine can affect very different applications, even when their own code does not have the defect in question. According to today’s W3Techs reports, PHP is used by 69.3% of sites identified with server-side language. This ratio measures your web presence, not the number of compromised sites.
The two defects carry the references. CVE-2026-109618 and CVE-2026-109619. With a score of 9.2 out of 10 according to the CVSS 4.0 grid, they affect internal memory management. The first can cause incorrect data processing after an interruption linked to lack of memory. The second allows the reuse of information whose memory has already been freed, when processing a subsequent request.
The consequences can go beyond a simple crash: under certain conditions, an attacker can cause the server to execute its own code.
The risk is particularly high with Apache using the module mod_php. The PHP team describes a demonstrated exploit where an unauthenticated request triggers the attack even before the app code starts working. PHP-FPM is also among the affected environments. Therefore, a site cannot be considered protected just because its publishing software is up to date.
Four corrected versions to install on servers
Following an alert published on October 20, the project released security updates. His official notice requests to immediately switch to the fixed version corresponding to the branch used:
- PHP 8.2.35 for branch 8.2;
- PHP 8.3.36 for branch 8.3;
- PHP 8.4.27 for branch 8.4;
- PHP 8.5.12 for branch 8.5.
In shared or managed hosting, implementation generally depends on the service provider. You should request confirmation that the two fixes have been applied to the environment that processes site requests. Releasing an update does not mean that all hosts already have it.
Linux distributions and extended maintenance providers have received the fixes in advance. Some may integrate them into their own packages while retaining an older PHP version number. In this case, the vendor’s security bulletin and the revision of the installed package help verify that the vulnerabilities are fixed.
the order php -v It constitutes a first check, but it only shows the version of the interpreter launched in the terminal. The one used by the web server may be different, especially when several versions coexist on the same machine. Therefore, the verification should focus on each environment actually used by the sites and then on the correct consideration of the engine corrected by the services concerned.
This intervention remains distinct from publishing software maintenance. Installing a version like WordPress 7.1 or fixing an Elementor bug does not automatically update the hosting’s PHP engine.
In php.ini, a temporary setting that does not replace the solution
For servers that are still pending upgrade, PHP describes a measure to limit certain session-related operational paths. It consists of disabling the tracking of the progress of file submissions, adding or modifying this directive in the file php.ini used by web server:
session.upload_progress.enabled = Offthen it is necessary restart all affected PHP processes : PHP-FPM when used, or Apache when PHP works as a module. Editing only the configuration file intended for the command line does not ensure that the configuration is applied to the sites. The configuration must be loaded before parsing queries; a call to ini_set() in a script arrives too late, and PHP also advises against trusting a file .user.ini with PHP-FPM for this measurement.
The scope of this change remains limited. HE official technical bulletin indicates that it blocks confirmed session-related attack paths for CVE-2026-109619, but not all variants. Therefore, it does not constitute complete protection against both defects.
This option is used to track the progress of a file sent to the server. Disabling it may affect progress indicators that rely on this mechanism, but does not prohibit uploads. It can remain disabled after the fix if the application does not need it.
Be careful with old branches
PHP 8.1 and earlier versions no longer benefit from normal project maintenance. Given the severity of these bugs, the team provided minimal fixes to integrate into the PHP 7.4, 8.0 and 8.1 source code. Extended support providers may also offer their own patched packages. These exceptional provisions do not reestablish normal control of these former branches.
For administrators remaining on PHP 8.2, another deadline is approaching: project security support will end on December 31, 2026. The installation of PHP 8.2.35 responds to the current urgency, while a migration to a more maintained branch must also be prepared.
