Critical PHP RCE (CVE-2026-109618): How to Patch Now

CVE-2026-109618 is a critical remote code execution flaw in PHP itself, published on 21 October 2026 with a CVSS v4 score of 9.2. An unauthenticated attacker can send a crafted HTTP request that pushes PHP into an out-of-memory error at the wrong moment, corrupt the request state, and run code as your web server user. It affects every supported branch. Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 today, then restart Apache or PHP-FPM. This post explains who is exposed, how to check your version in one minute, how to patch on the common setups, and what to do if you cannot patch tonight.

The vulnerability at a glance

Source: the official php-src security advisory GHSA-w8hw-w9fx-j79w.

What the bug is, in plain English

Every PHP request has a memory limit. When a request goes over it, PHP has to stop that request immediately. Until this fix, PHP did that with a low-level C jump (longjmp()) straight out of whatever it was doing and into the shutdown code.

The problem is timing. If memory runs out while PHP is still setting up the request, some of the request's internal structures are only half built. Shutdown then reads and acts on that half-built state as if it were valid. With careful control of what is in memory at that moment, an attacker turns "PHP ran out of memory" into "PHP used memory it had already freed", and from there into running their own code.

The attacker does not need your application to have a memory leak. The advisory describes several ways to drive a request to out-of-memory while staying inside PHP's normal limits, all in multipart (file upload style) request parsing:

• A multipart request without a usable declared length can slip past the initial post_max_size check.
• Each multipart part can carry an unlimited number of headers, and those headers take far more memory inside PHP than they do on the wire.
• Empty file fields do not count towards max_file_uploads but still create metadata arrays, and nested field names multiply the work.

Because this happens while PHP parses the request, it can fire before a single line of your application code runs. A WordPress, Laravel, Magento or custom site is exposed the same way: it is the PHP runtime that is vulnerable, not the CMS.

Who is exposed: mod_php, PHP-FPM, FrankenPHP, LiteSpeed

How PHP is plugged into your web server changes the risk. From the advisory's analysis:

• Apache with mod_php (prefork): highest risk. Apache runs request shutdown even when request startup failed, so the corrupted state is processed before any application code. Full remote code execution was validated over HTTP with default memory and input limits.
• PHP-FPM (nginx, Apache with proxy_fcgi, most modern hosting): lower but real risk. FPM exits the child process when startup fails, which blocks the easiest route. An out-of-memory error after startup can still reach the vulnerable code, but no complete FPM exploit has been shown yet.
• FrankenPHP: likely affected, based on source review, because it also calls shutdown unconditionally.
• LiteSpeed (LSAPI): modelled on FPM; application-specific exploits are considered likely but have not been validated.

Running many workers or busy traffic makes an attack take more attempts, but the advisory is clear that it does not remove the condition. Do not treat "we are on FPM" or "we have a lot of traffic" as a reason to wait.

How to check your PHP version in one minute

Pick whichever access you have.

On the server (SSH)

php -v
php-fpm8.3 -v        # or php-fpm -v, the FPM binary can differ from the CLI one
apache2ctl -M | grep php   # shows php_module if Apache uses mod_php

Check the binary the web server actually uses. The command-line php and the FPM pool are often different packages, and only the one serving web requests matters here.

From the browser or your laptop

Many servers announce their PHP version in a response header:

curl -sI https://example.com | grep -i x-powered-by
# X-Powered-By: PHP/8.3.21

If that line appears, attackers can read it too, which is how mass scanners pick targets. Our free website malware checker flags this kind of version disclosure, and you should turn it off with expose_php = Off in php.ini once you have patched.

On shared hosting or a control panel

Look for "PHP version" or "MultiPHP Manager" in cPanel, "PHP settings" in Plesk, or your host's dashboard. If you only see "8.3" with no patch number, ask the host directly whether the 8.3.36-level fix for CVE-2026-109618 is installed.

A note on Linux distribution packages

Debian, Ubuntu, RHEL and similar distributions often backport security fixes into their own package versions. A server that reports 8.2.29 from a distribution package can be patched, and one that reports a newer upstream number from a third-party repository might not be. For distribution packages, search the CVE in your distribution's security tracker and compare the package version, not the PHP version string.

How to patch PHP on common setups

The fix is a normal point release. There is no configuration change, and the patch keeps memory limits working; it only changes how PHP stops a request that hits them (a graceful stop at the next safe point, and a hard process exit if memory keeps climbing past a second threshold). Back up, update, restart, verify.

Ubuntu or Debian

sudo apt update
apt list --upgradable 2>/dev/null | grep -i php
sudo apt install --only-upgrade 'php8.*'
sudo systemctl restart php8.3-fpm   # match your version
sudo systemctl restart apache2      # if you use mod_php

If you use the widely used ondrej/php PPA or packages.sury.org repository, the same commands apply once the new builds are published there.

RHEL, AlmaLinux, Rocky (including Remi)

sudo dnf check-update 'php*'
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

Docker

Official images are rebuilt on new releases, but your running container is not. Pull the fixed tag, rebuild your image so it does not use a cached base layer, and redeploy:

docker pull php:8.4-fpm
docker build --pull --no-cache -t myapp .
docker compose up -d

Pin to an exact version such as php:8.4.27-fpm if you want to be certain which build you are running.

Shared or managed hosting

You cannot patch PHP yourself. Open a ticket today, quote CVE-2026-109618 and GHSA-w8hw-w9fx-j79w, and ask for the date the fix is installed on your server. Large hosts usually patch critical PHP issues fleet-wide within days, but a written answer is worth having.

Verify, then restart everything that runs PHP

Old worker processes keep the old code in memory until they restart. After updating, confirm the version the web server is really using (a temporary phpinfo() page that you delete straight after, or the X-Powered-By header before you hide it), and remember queue workers, cron runners and long-running processes such as Laravel Horizon, Octane, RoadRunner or Swoole.

If you cannot update tonight: partial mitigations

The advisory is explicit that updating is the only complete mitigation. These reduce exposure while you schedule the update; they do not close the hole.

• Block multipart requests where you do not use them. If a site has no file uploads or multipart forms, reject Content-Type: multipart/form-data at nginx, Apache, your CDN or WAF. This removes the main attack route described in the advisory.
• Keep request size small at the front end. Set a conservative post_max_size and enforce the request body size in the web server too (client_max_body_size in nginx, LimitRequestBody in Apache), so oversized bodies never reach PHP.
• Tighten PHP's input limits to what your application really needs, for example:

  max_input_vars = 1000
  max_input_nesting_level = 16
  max_file_uploads = 5
  max_multipart_body_parts = 200

• Use a container or cgroup memory cap (memory.max) as a backstop. The advisory warns against RLIMIT_AS and RLIMIT_DATA limits, because they can trigger the vulnerable path.
• Be careful with memory_limit = -1. The advisory lists it as a partial measure, but a failed mmap() can still hit the bug, and an unlimited PHP memory limit lets one bad request exhaust the whole server. Only use it together with a container memory cap.

The companion bug you should fix at the same time: CVE-2026-109619

The same releases fix CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), "RCE via stale global state", also rated 9.2. A fatal error, an out-of-memory error or an execution timeout can stop PHP from cleaning up global state between requests, and the next request on that worker then uses freed memory. It was confirmed against both mod_php and PHP-FPM, through session upload progress handling and through PHP 8.5 fatal error backtraces.

Updating fixes both. If you cannot update yet, the advisory's interim steps are:

• Set session.upload_progress.enabled = 0 and restart all workers (keep it off after patching if you do not use upload progress bars).
• On PHP 8.5, set fatal_error_backtraces = 0 and restart all workers.
• Prefer settings in php.ini or the FPM pool over per-request overrides in .htaccess or php_value, and fix fatal errors and timeouts that visitors can trigger.

After you patch: check for signs of compromise

A patch stops new attacks. It does not remove anything an attacker already planted. Code execution as the web user means an attacker could have written files anywhere that user can write, which on many sites includes the whole web root.

• Read the error log for bursts of "Allowed memory size exhausted" errors, segmentation faults or crashed workers around large multipart requests. The advisory notes a clean log does not prove a server is safe, but a noisy one is a strong lead.
• Look for new or changed PHP files in upload folders, cache folders and the web root: find /var/www -name '*.php' -newer /etc/hostname -mtime -14 is a quick start; adjust the path and window.
• Scan the site from outside. Run the free website malware checker for injected scripts, spam links and exposed files, and work through the signs your website is hacked.
• Rotate secrets the web user could read: database passwords, API keys in .env files, payment gateway keys.

Watch the site while you patch

PHP upgrades occasionally break things: a missing extension after the new package installs, an FPM pool that does not come back, a 502 from nginx because the socket path changed. Put the site under uptime monitoring before you start, so a failed restart reaches you in a minute, not from a customer email. You can also run a one-off check at upmonora.com/check straight after the restart. If something does go down, our website down checklist walks through the usual causes in order. Upmonora's free plan covers 5 monitors with SSL monitoring and needs no card.

Key takeaways

• CVE-2026-109618 is a critical, unauthenticated remote code execution bug in the PHP runtime, triggered by forcing out-of-memory errors during request parsing.
• Fixed versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Everything older on those branches is affected, whatever CMS or framework runs on top.
• Apache mod_php is confirmed exploitable; PHP-FPM, FrankenPHP and LiteSpeed should be patched just as urgently.
• Update and restart every PHP process. Workarounds such as blocking multipart requests and tightening input limits only reduce the risk.
• Fix CVE-2026-109619 in the same update, then check for signs of compromise and keep the site monitored.

Frequently asked questions

Which PHP versions fix CVE-2026-109618?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Every release below those on each branch is affected. If you use a Linux distribution package (Debian, Ubuntu, RHEL), the fix may be backported into a package whose version number looks older, so check your distribution security tracker for the CVE rather than comparing numbers only.

Am I affected if I use PHP-FPM instead of Apache mod_php?

Probably, but the risk is lower today. A full remote code execution exploit was only demonstrated against Apache mod_php. PHP-FPM can still reach the vulnerable code path after a request has started, and the related advisory CVE-2026-109619 was confirmed against PHP-FPM too, so the advice is the same: update.

Is there a public exploit?

The advisory does not publish a proof of concept. It states that full remote code execution was validated over HTTP against mod_php with default limits. Now that the fixes are public, attackers can compare the patched and unpatched code, so treat the window before exploits appear as short.

Can a WAF or php.ini setting fully protect an unpatched server?

No. The advisory says updating is the only complete fix. Limiting request size, multipart parts, input variables and uploads, or blocking multipart requests you do not need, makes the attack harder. Setting memory_limit to -1 is not complete either, because a failed mmap call can still reach the vulnerable path.

Ask AI about this article Opens your assistant with this article loaded as a source.

ChChatGPT (opens in a new tab) ClClaude (opens in a new tab) GeGemini (opens in a new tab) PePerplexity (opens in a new tab) GrGrok (opens in a new tab)