Security Updates
PHP Vulnerability CVE-2026-109618: Update PHP Now
Update PHP now: two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution on web servers. The PHP project released emergency security updates on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run WordPress, TYPO3, Matomo or any other PHP application, this PHP update is one of the most important security updates of the year.
What is the PHP vulnerability CVE-2026-109618 / CVE-2026-109619?
Both vulnerabilities are rated CVSS v4.0 9.2 (critical). According to the PHP security team, they can allow unauthenticated remote code execution (RCE): an attacker may be able to run their own code on a server with nothing more than a crafted web request, before any application code runs.
The issues sit in how PHP handles internal request state, among others around the session.upload_progress feature. Fixed versions were released on October 21 at 14:00 UTC (16:00 Vienna time). Shortly before, proof-of-concept research was already circulating publicly, so attackers are paying attention.
Which PHP versions are affected?
Practically every PHP installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. All PHP versions since PHP 5 are reported to be vulnerable. It does not matter whether a site is behind a reverse proxy, load balancer or container platform such as Traefik or Docker; the requests still reach PHP.
Fixed versions: PHP 8.2, 8.3, 8.4 and 8.5
| Branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older
PHP 8.1 and older no longer receive official updates. Some distributions and LTS vendors provide backports.
How to protect your server: PHP update checklist
1. Update PHP as soon as possible
Install the fixed version via your distribution's packages or rebuild/pull your Docker images (e.g. official WordPress or Matomo images) once updated images are available, then restart PHP-FPM or the web server.
2. Check every PHP application
Don't forget old test systems, forgotten subdomains, phpMyAdmin, staging sites and PHP versions that are still installed but no longer needed.
3. Don't rely on workarounds
Disabling session.upload_progress reportedly does not close the gaps completely. Configuration changes can reduce exposure, but only the PHP update fixes the problem.
4. Take sites offline if you can't patch yet
A static maintenance page served without PHP is a simple and effective temporary measure.
5. Check for signs of compromise
Review logs, look for new or modified PHP files, unknown users, processes and cron jobs.
How Team Vienna helps
On the day of the announcement we reviewed the servers we look after, checked them for signs of compromise, switched exposed PHP sites to static maintenance pages where needed, and are rolling out the patched versions as soon as the packages and images are available.
FAQ
Am I affected by CVE-2026-109618? Very likely, if your website runs on PHP and serves web requests. All PHP versions since PHP 5 are reported to be affected.
Which PHP version fixes the vulnerability? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Is my WordPress site affected? Yes, WordPress runs on PHP. Update the PHP version of your server or Docker image, not just WordPress itself.
Does a reverse proxy or Docker protect me? No. Requests still reach PHP behind Traefik, load balancers or containers.
Is there a workaround? No reliable one. Configuration changes can reduce exposure, but only the update closes the gaps. If you can't patch yet, serve a static maintenance page without PHP.
Not sure whether your website is affected, or need help with the PHP update? Get in touch with Team Vienna. We assess your setup, secure it and keep it up to date.
