PHP Critical Security Vulnerabilities: Patch 8.2 to 8.5

These flaws impact all PHP environments processing web requests, dating back to PHP version 5 in July 2004.124

Palo Alto Networks identified more than 22.6 million publicly exposed instances that may be vulnerable to the flaws across web hosting environments.3

The October 2026 critical vulnerability landscape

The two vulnerabilities are designated CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 out of 10 under the Common Vulnerability Scoring System. CVE-2026-109618 involves out-of-memory handling that interrupts PHP while internal request data is only partially initialized, leading to out-of-memory corruption. CVE-2026-109619 involves stale global state where request-owned internal state survives after its backing memory has been freed. The PHP Foundation published an initial advisory on October 20 without version details, before the official release on October 21.12

Wiz researchers dubbed their proof of concept 'php2shell' and noted that an unauthenticated attacker could execute code on vulnerable servers or read process memory. That exposed memory may contain authentication tokens, passwords, API keys, and certificates. Dave Ottenheimer noted that an attacker might only need to upload a specially crafted file through a vulnerable upload form.12

Immediate configuration mitigations for high-risk setups

The PHP Foundation and security advisories emphasize that there are no complete mitigations other than updating the runtime software. Official WordPress guidance confirms that no separate WordPress update is required or planned, and WordPress administrators can check their active PHP version by navigating to Tools, opening Site Health, and expanding the Server section under the Info tab. Temporary mitigations should not replace official security updates, and the UK National Cyber Security Centre advises organizations to consider taking exposed systems offline if security fixes cannot be applied quickly.124

If immediate binary upgrades are not possible, administrators should disable session upload progress by setting session.upload_progress.enabled=0, set memory_limit=-1 preferably via php_admin_value so applications cannot override it, and restrict post_max_size to 8M (or 32M if file uploads are necessary).1

Deployment risks across server architectures

All PHP environments serving web requests face exposure, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. However, the highest risk configuration is mod_php, where a demonstrated exploit allows an unauthenticated request to trigger code execution before any application code runs.1

Planning for the PHP 8.2 end-of-life deadline

Official support and binary patches for these vulnerabilities are only provided for PHP 8.2 and newer releases. However, PHP 8.2 will reach end of life on December 31, 2026, receiving zero security updates past that date. While the PHP security team published minimal source-backports for PHP 7.4, 8.0, and 8.1 to assist source builds, legacy versions receive no official package maintenance.124