Critical PHP Vulnerabilities: CVE-2026-109618 & 109619

Critical PHP Security Alert: Website Owners Should Act Immediately

The PHP security team has released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated attackers to execute arbitrary code on vulnerable web servers.

Disclosed on October 21, 2026, both vulnerabilities carry a CVSS v4.0 severity score of 9.2 out of 10, placing them in the critical category. The issues affect PHP’s core runtime, the technology that powers millions of websites and web applications, including WordPress, WooCommerce, Drupal and Joomla.

According to the official PHP security advisory, all PHP installations serving web requests should be assessed for exposure. Website owners, hosting providers, system administrators and development teams are strongly advised to review their PHP environments and apply the appropriate security updates without delay.

At Reliqus, our expert team recommends treating this as an urgent website and server security priority, particularly for businesses operating internet-facing websites and eCommerce platforms.

What Are CVE-2026-109618 and CVE-2026-109619?

These vulnerabilities, sometimes referred to collectively as PHP2Shell, originate in PHP’s internal memory and error-handling mechanisms. Under certain conditions, a specially crafted request can trigger a flaw that may allow an attacker to execute malicious code with the privileges of the PHP process.

1. CVE-2026-109618: Remote Code Execution Through Memory Corruption

This vulnerability involves PHP’s handling of out-of-memory conditions. When PHP encounters a memory allocation failure during request processing, internal request data may be left partially initialized. Subsequent cleanup operations can then handle invalid memory as if it were valid.

If successfully exploited, this can potentially allow an attacker to execute arbitrary code on the affected server.

Potential impact:

• Unauthorized execution of server-side commands.
• Access to website configuration files and sensitive credentials.
• Unauthorized modification of website files and application data.
• Potential compromise of the website or hosting environment.

2. CVE-2026-109619: Remote Code Execution Through Stale Memory State

The second vulnerability involves internal request state referencing memory that has already been freed. Under specific conditions, a later request handled by the same worker may use this stale state before it is properly reset.

This use-after-free vulnerability can potentially enable memory corruption and remote code execution.

Potential impact:

• Unauthorized execution of code through vulnerable request-processing paths.
• Potential exposure of sensitive information held in process memory.
• Website defacement, malicious code injection or backdoor installation.
• Further compromise of systems accessible to the affected PHP process.

The actual impact depends on the server configuration, execution privileges and the attacker’s ability to exploit the vulnerable code paths. A vulnerable installation is not necessarily already compromised, but it should be treated as a security risk until remediated.

Which PHP Versions Are Affected?

PHP installations running versions below the relevant patched releases should be considered potentially vulnerable. Older, unsupported PHP versions also require immediate attention.

The following table lists the minimum patched upstream versions published by the PHP project.

Important: PHP 8.1 and older versions no longer receive security updates from the PHP project. Some operating-system distributions and long-term support vendors may provide backported fixes. Confirm the status with your hosting or software vendor rather than relying on the version number alone.

If your website is running an older PHP version, upgrading may require compatibility testing before deployment. However, compatibility concerns should not become a reason to leave an internet-facing server exposed indefinitely.

For the latest official information, consult the PHP Security Advisory.

Why Is This Security Issue Urgent?

The primary concern is that successful exploitation may not require an attacker to authenticate to the vulnerable application first. This significantly increases the importance of identifying exposed systems and applying the relevant patches.

The vulnerabilities can affect multiple PHP execution environments, including:

• PHP-FPM, commonly used with Nginx and Apache.
• Apache running PHP through mod_php.
• PHP-CGI.
• FrankenPHP and LiteSpeed environments.

The PHP project identifies Apache mod_php as a particularly high-risk configuration because a demonstrated attack can trigger the vulnerability before application code runs.

For businesses, the consequences of a successful server compromise can extend beyond a website outage. Depending on the environment and permissions, attackers may be able to access credentials, modify website content, compromise customer information or establish persistent access.

WordPress and other PHP-based applications may be exposed even when their core software, themes and plugins are fully updated. Updating WordPress alone does not fix a vulnerability in the underlying PHP runtime.

This is why website owners should coordinate with their hosting providers and development teams instead of relying exclusively on routine CMS updates.

How to Fix CVE-2026-109618 and CVE-2026-109619

The recommended solution is to upgrade every affected PHP installation to an appropriate patched release and verify that the web server is using the updated runtime.

Step 1: Identify Your Current PHP Version

Check the PHP version used by your live website, not just the version installed for command-line operations.

For example, if you have SSH access, run:

php -v

This displays the CLI PHP version. Your website may use a different version through PHP-FPM, Apache or a hosting control panel.

For cPanel and WHM environments, review the PHP versions assigned to individual domains through MultiPHP Manager or the applicable hosting configuration.

Step 2: Upgrade to a Patched PHP Release

Upgrade to the relevant patched version:

• PHP 8.5.12 or later within the supported branch.
• PHP 8.4.27 or later within the supported branch.
• PHP 8.3.36 or later within the supported branch.
• PHP 8.2.35 or later within the supported branch.

Where an operating-system vendor supplies a security-patched package, follow its official instructions and verify that the relevant CVEs are addressed.

For production websites, test the upgrade in a staging environment whenever practical. Check theme and plugin compatibility, custom PHP code, checkout flows, forms, payment integrations and other critical functionality before completing deployment.

Step 3: Restart and Verify PHP Services

After applying the update, restart or reload the relevant PHP services as required by your hosting environment. This ensures that existing worker processes are not continuing to run an older vulnerable runtime.

Verify the version used by the live website and confirm that all applicable PHP handlers and worker pools have been updated.

Step 4: Review Website and Server Security

Patching is the essential first step, but it does not establish whether a system was previously compromised.

Review relevant web server, PHP, authentication and system logs for unusual requests or activity. Investigate unexpected processes, modified PHP files, unfamiliar administrator accounts, suspicious outbound connections and other indicators of compromise.

If evidence of a breach is found, preserve relevant logs, investigate the scope of the incident and follow an appropriate incident-response process. Changing credentials and restoring clean files may also be necessary, depending on the findings.

Step 5: Apply Temporary Mitigations if an Immediate Upgrade Is Not Possible

The official PHP advisory describes configuration measures that can block certain known attack paths, including request-size limits and specific session upload-progress settings.

However, these measures are incomplete and should not be considered a substitute for applying the security patches. If an exposed system cannot be patched promptly, assess whether it should be isolated from public access until remediation is complete.

What Should WordPress and WooCommerce Website Owners Do?

WordPress websites are particularly relevant because PHP is fundamental to their operation. The same applies to WooCommerce stores and many custom PHP applications.

Website owners should take the following actions:

1. Check the server’s PHP runtime. Confirm the version actually serving the website.
2. Contact the hosting provider. Ask whether the relevant PHP security updates have been installed and whether all assigned PHP versions are covered.
3. Update the runtime. Do not assume that updating WordPress core, plugins or themes addresses this issue.
4. Check compatibility. Test essential functionality following the PHP upgrade.
5. Review security indicators. Investigate suspicious activity, particularly on publicly accessible websites.
6. Verify all environments. Include staging sites, subdomains, additional PHP versions, background workers and any other systems that may contain vulnerable PHP installations.

For agencies managing multiple client websites, a coordinated audit is recommended. A single hosting account or server may contain multiple websites using different PHP versions, so updating one domain does not necessarily resolve the risk across the entire environment.

Reliqus Expert Team Recommendation

Our recommendation is to prioritise this issue according to exposure and business impact.

Start with publicly accessible production servers, eCommerce websites, customer portals and applications that process untrusted input. Identify the PHP runtime behind each application, coordinate the patching process with the hosting provider and verify the fix after deployment.

Businesses running unsupported PHP versions should plan a move to a supported release rather than relying indefinitely on legacy software. Where compatibility problems exist, a controlled migration with appropriate testing is preferable to leaving a critical vulnerability unresolved.

Website security is not limited to installing a firewall or keeping plugins updated. The underlying server environment, PHP runtime, application code and hosting configuration all contribute to the security of a website.

Taking action now can reduce the window of exposure and help protect business operations, customer data and website availability.

Need Help Upgrading PHP or Securing Your Website?

Reliqus can help you assess your PHP environment, plan the upgrade and verify your website after remediation.

If you manage a WordPress website, WooCommerce store or custom PHP application and are unsure whether your server is affected, our team can help you identify the current runtime, coordinate the necessary updates and test critical functionality.

Our website development and technical support services can help businesses address PHP compatibility issues, maintain their websites and improve their overall security posture.

Contact Reliqus today to discuss a PHP security upgrade, website maintenance or a technical security assessment.

Do not wait for a website outage or security incident to discover that your server is running a vulnerable PHP version. Take the necessary steps to secure your website now.

Recommended next step: Get in touch with the Reliqus team to review your PHP version and plan your security upgrade.

Official References

• PHP Security Advisory: Critical Remote Code Execution Vulnerabilities
• Google Cloud: Response to CVE-2026-109618 and CVE-2026-109619
• Canadian Centre for Cyber Security: PHP Vulnerability Alert

This article is intended for informational purposes. Security status and remediation requirements may vary by operating system, hosting provider and PHP distribution. Always verify the applicable vendor advisory before performing production upgrades.