Critical PHP Security Alert: CVE-2026-109618 and CVE-2026-109619

Last Updated: 23 October 2026

Two critical security vulnerabilities have been identified in PHP, the server-side programming language used by many websites and web applications. The PHP development team released security updates on 21 October 2026 to address CVE-2026-109618 and CVE-2026-109619.

These vulnerabilities could allow an unauthenticated attacker to execute malicious code remotely on an affected server. They may also expose sensitive information through memory-related issues. Both vulnerabilities have a CVSS v4.0 score of 9.2, placing them in the critical severity category. They affect the PHP runtime itself and may put websites, applications, and the underlying hosting environment at risk. Website owners, developers, and server administrators should review their PHP installations and apply the appropriate security updates immediately.

At BuySSL.LK, we believe website security requires multiple layers of protection. An SSL/TLS certificate is an important part of securing a website, but keeping server software updated is equally important.

What Are CVE-2026-109618 and CVE-2026-109619?

The vulnerabilities involve memory management and internal request handling within PHP. Successful exploitation may allow an attacker to execute code on an affected server without first authenticating to the application.

CVE-2026-109618: Out-of-Memory Corruption

This vulnerability relates to how PHP handles an out-of-memory (OOM) condition during request processing. Under certain circumstances, PHP may interrupt processing while internal request data is only partially initialized. During cleanup, the runtime may incorrectly treat this incomplete data as valid, potentially resulting in memory corruption. An attacker may be able to exploit this behavior to execute malicious code on the vulnerable system.

CVE-2026-109619: Stale Global State

This vulnerability involves internal request-related state that remains available after the memory supporting it has been released. A subsequent request handled by the same PHP worker may access this stale state before it is properly reset. Under certain conditions, this may also lead to remote code execution. Both vulnerabilities affect the PHP runtime rather than a specific website theme, plugin, or content management system. Updating WordPress or another application alone does not fix a vulnerable PHP installation.

Which Websites and PHP Installations Are Affected?

Any vulnerable PHP installation serving web requests should be assessed. Potentially affected environments include:

• WordPress websites and other PHP-based content management systems.
• E-commerce websites and online stores.
• Business websites and custom PHP applications.
• Websites built with frameworks such as Laravel.
• Applications running on shared hosting, VPS, or dedicated servers.
• PHP environments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.
• Containerized applications that include vulnerable PHP packages.

The PHP development team identifies Apache with mod_php as a particularly high-risk configuration because a demonstrated exploit can trigger the vulnerability before application code runs. However, other PHP configurations should not be assumed safe. Administrators should identify all PHP installations serving web requests and check whether the required security fixes have been applied.

Affected PHP Versions and Fixed Releases

The PHP development team has published security releases for the following branches.

These releases address CVE-2026-109618 and CVE-2026-109619.

Important: PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. Some operating system vendors and extended-support providers may offer backported security fixes for older versions. The PHP project has also published limited source backports for selected older branches.

If your website uses an older PHP version, consult the relevant software or hosting vendor to establish whether a suitable security patch is available. Do not assume that an older installation is protected simply because its version number appears unchanged. PHP 8.2 is scheduled to reach end of life on 31 December 2026. Administrators using PHP 8.2 should plan a migration to a supported branch before regular security updates end.

For the official release information, visit the  PHP Security Advisory.

Does an SSL Certificate Protect Against These PHP Vulnerabilities?

An SSL/TLS certificate protects the connection between a website and its visitors by enabling encrypted HTTPS communication and helping browsers verify the website's identity. However, an SSL certificate does not fix vulnerabilities in PHP, the web server, the operating system, or application code. For example, a website may have a valid SSL certificate and display the secure HTTPS connection in a browser. If the server is running a vulnerable PHP version, the application may still be exposed to attacks that exploit the PHP runtime. These are two different aspects of website security:

SSL/TLS protection

• Encrypts information transmitted between the browser and the server.
• Helps protect data from interception or modification in transit.
• Enables HTTPS connections and supports website identity verification.

PHP and server security

• Requires applying security patches to vulnerable software.
• Includes updating PHP packages and relevant hosting control panel components.
• Requires maintaining the operating system, web server, and website applications.

A valid SSL certificate and a patched PHP environment serve different purposes. Both should be part of a website's overall security strategy.

What Should Website Owners Do?

Website owners should work with their hosting provider or server administrator to verify that the correct security updates have been applied.

1. Check the PHP Version

Identify the PHP version used by your website, including any separately configured subdomains or applications. If you manage multiple websites, check each PHP installation rather than assuming that all applications use the same version.

2. Apply the Appropriate Security Updates

Update vulnerable PHP installations to the relevant fixed release or install a vendor-provided security patch for the specific package and environment. If you use managed hosting, contact your hosting provider to confirm that the required system-level updates have been applied. Simply selecting a newer PHP version in your website control panel does not guarantee that every PHP package or server component has been patched.

3. Update Your Website Software

Keep your content management system, themes, plugins, frameworks, and application dependencies up to date. Although application updates do not replace a PHP security patch, maintaining current software helps reduce additional security risks.

4. Maintain Website Backups

Keep recent backups of your website files, databases, and important configurations. After updating PHP, test the website to verify that its features continue to work correctly. If you suspect the server was compromised before the update, investigate the incident instead of assuming the patch has removed any malicious changes.

5. Review Your Hosting Environment

If you manage a VPS or dedicated server, check every relevant PHP installation, including versions used by background services and containers. If you use shared hosting, ask your hosting provider whether the required security fixes have been applied. For cPanel and Plesk environments, follow the official vendor instructions outlined below.

Security Updates for cPanel & WHM

cPanel has published security updates for cPanel & WHM and its EasyApache 4 PHP packages. The official cPanel advisory lists patched builds for several PHP branches, including:

cPanel & WHM also has specific patched release levels. CloudLinux-provided PHP packages may use different build numbers, so administrators should check the applicable vendor guidance.

Read the complete instructions here:  cPanel – Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619

Security Updates for Plesk

Plesk has published an advisory covering the affected PHP packages shipped with Plesk Obsidian and the PHP components used by the control panel. For the main PHP branches, the fixed releases are:

Plesk also identifies patched builds for selected older PHP versions. In these cases, the displayed PHP version number may remain unchanged, so checking the package build date is important. The Plesk Obsidian control panel has its own patched update levels. Administrators should therefore verify that both the relevant PHP packages and the control panel components have been updated.

Refer to the official advisory for the applicable operating system, package versions, and update instructions:  Plesk – PHP2Shell: Remote Code Execution in PHP Shipped with Plesk

What If You Cannot Apply the Update Immediately?

The PHP development team states that updating to a fixed release is the only complete solution. If an immediate update is not possible, administrators should review the temporary mitigation steps in the official PHP advisory and assess the exposure of affected services.

Temporary measures may reduce exposure to specific attack paths, but they do not make a vulnerable installation fully safe. Where an affected service cannot be secured promptly, consider whether it should be isolated or taken offline until the update can be applied. If you suspect that your server has already been compromised, investigate possible unauthorized access, unexpected processes, and suspicious file changes.

Further guidance is available from the  UK National Cyber Security Centre.

How BuySSL.LK Supports Your Website Security

Website security depends on more than one technology. Keeping server software updated and using HTTPS together help address different security requirements. BuySSL.LK provides SSL certificates from recognised Certificate Authorities, with support for certificate selection, domain validation, installation, configuration, and renewal. Our available SSL options include Domain Validation (DV), Organization Validation (OV), Extended Validation (EV), Wildcard SSL, and Multi-Domain certificates to suit different website requirements.

If you need assistance selecting or installing an SSL certificate, visit  BuySSL.LK. For PHP security updates, server-level patching, or hosting control panel issues, contact your hosting provider or system administrator. SSL installation alone cannot resolve a vulnerable PHP runtime.

Conclusion

CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that may allow unauthenticated remote code execution on affected systems. Website owners and server administrators should identify their PHP installations, apply the appropriate security updates, and verify that all relevant packages and hosting control panel components are protected.

A valid SSL/TLS certificate remains an important part of website security, but it does not replace software patching. Combining HTTPS protection with regular server maintenance, current application software, and reliable backups helps build a stronger security foundation. For technical remediation instructions, consult the official PHP, cPanel, and Plesk advisories listed below.

• PHP Official Advisory: Critical Remote Code Execution Vulnerabilities – Update Now
• cPanel & WHM: Critical PHP Security Release – CVE-2026-109618 and CVE-2026-109619
• Plesk: PHP2Shell – Remote Code Execution in PHP Shipped with Plesk
• Google Cloud: Responding to Core PHP Vulnerabilities
• UK National Cyber Security Centre: Critical Security Issue Affecting PHP
• BuySSL.LK: SSL Certificates and Website Security