PHP has released emergency security updates for two critical vulnerabilities that can allow unauthenticated remote code execution on installations that serve web requests. The project says administrators should move immediately to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on the supported branch they run.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, matter because the affected software sits beneath a vast range of websites and web applications. The practical exposure is not every site using PHP: it depends on the release, server integration, configuration and whether the installation has been patched. But the PHP security advisory identifies web-serving deployments as the affected class and documents a demonstrated attack path against Apache’s mod_php integration that can be initiated without authentication before application code executes.
What PHP fixed
PHP describes both vulnerabilities as critical. CVE-2026-109618 concerns error handling when the runtime runs out of memory: partially initialized internal request data can create conditions for code execution. CVE-2026-109619 involves request-owned state that can remain available after the memory backing it has been freed. In both cases, the issue lies in the runtime’s internal handling of a web request rather than in a defect a site owner would necessarily see in an application framework or plug-in.
The advisory names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the web-serving setups within scope. That list is important for incident response. PHP is commonly discussed as though it were one uniform web-server component, but it can be deployed through materially different execution models. The project’s strongest warning concerns mod_php, where it says a working exploit was demonstrated from an unauthenticated request before the target site’s own PHP application code ran.
A demonstrated exploit is not the same as evidence of exploitation in the wild. PHP’s notice establishes that the mod_php route is exploitable under the conditions tested; it does not say attackers have used either vulnerability against live sites. Nor does the advisory support broad claims that a defined share of the entire web is vulnerable. Its technical scope is PHP installations serving requests, not a census of exposed domains.
Current branches have packages; older estates have a different problem
The October 21 release delivers fixes in four maintained lines: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For organizations on those branches, the immediate task is comparatively straightforward in principle: obtain the updated package or build from the relevant supplier and ensure the public-facing deployment is actually running the corrected runtime.
The more awkward cases are PHP 8.1 and older. Those releases no longer receive regular updates from the PHP project. For this incident, PHP supplied minimal source backports for versions 7.4, 8.0 and 8.1, an exceptional measure that should not be confused with restoring those branches to normal support. The advisory also notes that some Linux distribution and long-term-support vendors may make their own backported fixes available.
That leaves administrators of legacy applications needing to establish what code and packages their environment actually uses, rather than assuming a nominal PHP version tells the whole story. A distribution-maintained build may carry a security repair without adopting the newest upstream version number; a custom build or unsupported appliance may have no ready-made fix at all. PHP’s position is clear: configuration measures may reduce exposure to particular paths, but only an update is a complete remedy.
Web-scale estimates need careful reading
The urgency of the release has produced sweeping descriptions of the internet-wide risk. Those should be treated cautiously. PHP does not publish an estimate of how many websites are affected, and a public web scan cannot observe every server, determine every configuration or reliably identify PHP versions that sites choose not to disclose.
Security company Melurna, which wrote about the vulnerabilities and the release timeline, said that 48.6% of the 1,719,818 PHP sites in its scan that revealed a version were on an end-of-life branch. The qualifier is substantial: the number describes a fingerprintable subset that exposed version information, not all PHP sites or all websites. It is useful evidence that legacy deployments remain common, but it is not an internet census and does not establish that every such site is exploitable.
Melurna also reported that the PHP security team gave advance notice of an emergency release on October 20, followed by the public fixes the next day. The short interval reflects the severity of an unauthenticated code-execution issue in a server-side runtime, where an attacker may not need a valid account or a vulnerable application feature to begin probing an exposed service.
For site operators, the immediate priority is to identify internet-facing PHP request handlers and their effective patch level, with particular attention to mod_php deployments and systems that remain on discontinued branches. The release offers corrected versions for current lines and unusual source backports for several old ones, but it does not remove the longer-term maintenance burden created by software that has already reached end of life.
