InOneWeb blog
Critical PHP Security Update October 2026: Two RCE Vulnerabilities
Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 require urgent updates. Learn which PHP versions are affected and how to protect your business.
October 22, 2026 — An urgent PHP security update has been released to address two critical vulnerabilities that could allow attackers to execute malicious code on affected servers without authentication.
On October 21, 2026, the PHP development team published emergency security updates for PHP 8.2, 8.3, 8.4, and 8.5.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both received a critical severity rating of 9.2 out of 10 under CVSS 4.0.
Unlike ordinary application-level security issues, these vulnerabilities affect the PHP runtime itself. This means that even applications with well-written, carefully maintained code may be exposed if their servers run vulnerable PHP versions.
For businesses relying on PHP-powered websites, e-commerce platforms, customer portals, or internal applications, this security release deserves immediate attention.
What Are the Two Critical PHP Vulnerabilities?
Both vulnerabilities involve memory management problems within the PHP runtime and may allow remote code execution (RCE).
CVE-2026-109618 — Out-of-Memory Handling Vulnerability
This vulnerability affects how PHP handles certain out-of-memory conditions.
When an operation fails because of memory allocation problems, PHP may interrupt request processing while internal data structures are only partially initialized.
Subsequent cleanup operations can then interact with invalid memory, potentially allowing an attacker to execute malicious code.
CVE-2026-109619 — Stale Global State Vulnerability
The second vulnerability involves internal PHP state that may continue referencing memory after it has been released.
Under specific conditions, subsequent requests can interact with this stale memory state, creating another potential path to remote code execution.
Both vulnerabilities may be exploitable without authentication. An attacker does not necessarily need a user account or administrative access to attempt exploitation.
Which PHP Versions Are Affected?
The PHP security team has released the following patched versions:
| PHP Branch | Security Update |
|---|---|
| PHP 8.5 | PHP 8.5.12 |
| PHP 8.4 | PHP 8.4.27 |
| PHP 8.3 | PHP 8.3.36 |
| PHP 8.2 | PHP 8.2.35 |
Earlier releases within these branches are affected and should be updated immediately.
PHP 8.1 and older versions are no longer officially supported by the PHP project. Some operating system distributions and commercial support providers may offer backported security fixes, but applications running these versions require particular attention.
Businesses still using PHP 5.x, PHP 7.x, or older PHP 8.x releases should verify whether their environments are receiving vendor security patches and develop a migration plan to a supported PHP version.
PHP 8.2 is also approaching its official end of life on December 31, 2026, making a longer-term upgrade strategy important even after applying this emergency patch.
Why Is This Security Update Particularly Serious?
Many vulnerabilities depend on specific application coding mistakes, insecure plugins, or incorrectly configured permissions.
These newly disclosed vulnerabilities are different because they exist within PHP's underlying execution environment.
The official PHP security advisory identifies installations serving web requests as potentially affected, including deployments using:
- PHP-FPM
- Apache with mod_php
- php-cgi
- LiteSpeed
- FrankenPHP
The PHP security team considers the risk especially serious for Apache mod_php configurations, where a demonstrated attack can be triggered before application-level code is executed.
Successful exploitation could potentially allow attackers to compromise the affected PHP process, access sensitive information, modify application files, or interfere with business operations, depending on the privileges and configuration of the server.
A secure application cannot fully compensate for a vulnerable runtime underneath it.
What Should Businesses Do Immediately?
Organizations running PHP applications should prioritize the following actions.
1. Identify the PHP Version Used in Production
Check the PHP version actually serving your website or application.
Remember that the command-line PHP version may differ from the version used by your web server.
If your business uses multiple servers, hosting accounts, or containers, verify each environment separately.
2. Install the Appropriate Security Patch
Update PHP to the latest patched release available for your supported branch.
For installations managed by a hosting provider, operating system vendor, or control panel, use the appropriate vendor-supplied packages.
Some vendors provide backported security fixes, so the displayed PHP version alone may not establish whether a particular installation is vulnerable.
3. Verify Application Compatibility
Although security maintenance releases are intended to minimize compatibility issues, production applications should still be tested after updating.
Pay particular attention to:
- Authentication and user sessions.
- Payment processing and checkout workflows.
- Database operations.
- External API integrations.
- File uploads and document processing.
- Scheduled background tasks.
- Business-critical custom functionality.
4. Review Server Logs and Security Monitoring
Review relevant web server, PHP, and application logs for unusual behavior.
Unexpected crashes, suspicious requests, unusual processes, or unauthorized file modifications may require further investigation.
Updating the runtime removes the known vulnerabilities but does not automatically undo a compromise that may already have occurred.
5. Prepare a Migration Plan for Unsupported PHP
If your application still relies on PHP 5.x, PHP 7.x, or PHP 8.1, updating may be more complicated than installing a routine patch.
Older frameworks, dependencies, and custom application code may require changes before running correctly on a supported PHP version.
However, that does not automatically mean the entire application must be rewritten.
Why Legacy PHP Applications Need Special Attention
Many established businesses still rely on PHP applications developed years ago.
These systems may handle orders, customer records, invoices, internal workflows, or other essential business operations.
Some are built using older frameworks such as CodeIgniter 2 or CodeIgniter 3. Others rely on custom PHP architectures and libraries that are no longer actively maintained.
For these businesses, an urgent security update can reveal a larger problem: their software depends on technology that is becoming increasingly difficult to maintain securely.
Replacing the application completely may be expensive, time-consuming, and operationally risky.
But leaving the system unchanged is not a sustainable security strategy either.
The practical alternative is controlled modernization.
How InOneWeb Helps Businesses Secure and Modernize Legacy PHP Applications
At InOneWeb, we specialize in maintaining, stabilizing, and modernizing existing PHP applications.
Our approach is based on a simple principle:
Keep what works. Fix what creates risk. Modernize without unnecessary rewrites.
For businesses affected by the latest PHP security updates, we can help with:
- PHP version and compatibility assessment: Identifying outdated runtimes, libraries, and framework dependencies.
- Security update planning: Determining a safe approach to applying necessary patches.
- Legacy PHP migration: Adapting existing code to supported PHP versions while preserving business functionality.
- CodeIgniter modernization: Addressing compatibility and maintenance challenges in older CodeIgniter applications.
- Regression testing: Checking critical workflows and integrations before production deployment.
- Long-term maintenance planning: Reducing technical debt and preparing applications for future security updates.
Not every outdated system needs to be replaced.
In many cases, targeted changes and a carefully planned migration can extend the useful life of existing business software while reducing operational risk.
Start with a Legacy PHP Health Check
If you are unsure whether your PHP application is affected by the latest vulnerabilities, the first step is to understand your current environment.
InOneWeb offers a Legacy PHP Health Check to help identify important security, compatibility, and maintenance concerns.
This assessment helps establish which problems require immediate attention, which components can be preserved, and what a realistic modernization path might involve.
There is no need to commit to a complete software rewrite before understanding the actual risks.
Don't Wait for a Security Incident to Force an Upgrade
The October 21, 2026 PHP security release is an important reminder that maintaining a business application involves more than keeping its existing functionality operational.
Unsupported runtimes and delayed security updates can expose otherwise reliable software to serious risks.
If your PHP environment has not yet received the relevant security patches, updating should be an immediate priority.
And if an older application cannot be updated easily, now is the time to plan its modernization.
Need Help Securing Your PHP Application?
Whether you need assistance evaluating the latest security update, upgrading an outdated PHP runtime, or modernizing a legacy business application, InOneWeb can help you identify a practical path forward.
Contact us to discuss your PHP environment or request a Legacy PHP Health Check.
Email: contact@inoneweb.biz
Website: https://inoneweb.biz/
InOneWeb — Practical PHP modernization. Without unnecessary rewrites.