Skip to main content

Critical PHP security update: what you need to know

PHP has released fixes for two critical remote code execution vulnerabilities. We’re rolling them out now. Here’s what they are and what you need to do.

Critical PHP security update: what you need to know

Jimmy Crutchfield

· Updated · Security & compliance

Update, 23 October: We are aware of an additional advisory from the PHP team regarding session upload progress (CVE-2026-115560). This functionality remains disabled on our fleet.

Update, 22 October, 22:00: every server is patched.

  • Prostack Cito: fixes backported to PHP 5.6 through to 8.4.
  • CloudLinux: CloudLinux’s backported fixes from PHP 5.2 upwards.
  • cPanel: cPanel’s backported fixes from PHP 7.4 upwards. Sites on cPanel’s own PHP versions below 7.4 need to be updated.

Backported fixes may not change the PHP version number. To confirm the patch, check phpinfo(): the build date will show Oct 21st.

The PHP security team has released fixes for two critical vulnerabilities, both rated 9.2 out of 10 (CVSS v4.0), that can allow someone with no account and no access to your site to run their own code on the server. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team state that there are no complete mitigations and updating is the only safe choice.

Versions that are out of support do not get a normal release. This includes all versions below 8.2. Given the severity, the PHP team has published minimal source patches for 7.4, 8.0 and 8.1, and says Linux distributions and long-term-support vendors received the fixes in advance. Whether a patched package exists for an old version depends on the vendor that packages it. Backported fixes are now available: CloudLinux have patched PHP 5.2 upwards, cPanel have patched 7.4 upwards, and we have patched 5.6 to 8.4 on Cito.

What the vulnerabilities are

Both are memory-safety bugs in the way PHP starts and finishes handling a request. They are in PHP itself, so every site is affected regardless of CMS, framework or plugins.

  • CVE-2026-109618: remote code execution via out-of-memory corruption (GHSA-w8hw-w9fx-j79w). When PHP runs out of memory it bails out abruptly. If that happens while a request is only partly set up, the cleanup code that runs afterwards can act on half-initialised data. An attacker can force the out-of-memory condition with a crafted form upload that stays within PHP’s normal limits, for example by sending a request without a usable content length, or multipart parts with enormous numbers of headers.
  • CVE-2026-109619: remote code execution via stale global state (GHSA-6wmf-4rv5-p3rp). A PHP worker process handles many requests in a row. Some internal state from one request can survive into the next after its memory has been freed, and a later request on the same worker can use it before PHP resets everything. The confirmed attack routes are PHP’s session upload progress feature and, on PHP 8.5 only, fatal error backtraces.

The PHP team rates the risk highest for Apache’s mod_php, where they have demonstrated a working exploit with default settings, triggered before any application code runs. PHP-FPM is less exposed to the first bug, but exploitation of the second has been demonstrated against it too. LiteSpeed’s LSAPI is described as likely susceptible but unverified. Every server running PHP should be treated as vulnerable until it is patched.

The technical details are now public, so working exploits are likely to appear within hours.

What we’re doing

We rolled out the fixed PHP packages as soon as they were released. These updates did not incur downtime.

  • Prostack Cito servers: done. Every Cito server has been updated. We backported the fixes to PHP 5.6 through to 8.4, so sites on end-of-life versions are patched as well. That does not make those versions supported, and the advice below to upgrade still stands.
  • CloudLinux servers: done. Every server running CloudLinux has been patched, including CloudLinux’s backported fixes for PHP 5.2 upwards.
  • cPanel servers: done. Every cPanel server has cPanel’s updated PHP packages for 8.2, 8.3, 8.4 and 8.5.
  • PHP 8.1 and older on cPanel: done for 7.4 and above. cPanel backported the fix from PHP 7.4 upwards and those packages are installed. Sites running PHP below 7.4 on cPanel have not received a patch and need to be updated.

Upload progress will remain disabled. The advisory confirms that disabling session.upload_progress, which we did this morning, blocks the confirmed session route for CVE-2026-109619. It recommends leaving it disabled after patching if it isn’t needed, and we will. It does not protect against CVE-2026-109618, so it is a precaution rather than a fix.

We’ve reviewed the other interim mitigations in the advisory. They involve removing PHP’s memory limit entirely or capping request sizes low enough to break uploads, and the PHP team describe them as reducing exposure rather than removing it. As patches are now available, we are installing those rather than applying partial workarounds that could break your site.

If you use Cloudflare

Your site has extra protection if its traffic goes through Cloudflare’s proxy. Cloudflare has deployed firewall rules for both vulnerabilities, on by default for every plan with the WAF, including Free. They have been in place since 03:02 UTC on 21 October, around nine hours before the fixes were released.

Cloudflare say they saw attack traffic before the official release, and that attackers are changing their payloads to try to get past the rules. Their analysts are updating the rules as new techniques appear, and some of the rules also check your server’s response to catch an attack that gets through. If you’re on a paid plan, check that the Cloudflare Managed Ruleset is deployed in block mode.

The rules are an extra layer, not a fix. Cloudflare make the same point we do: updating your site’s code or plugins does nothing here. PHP itself has to be patched, which means keeping your site compatible with up-to-date PHP versions.

What you need to do

If your site runs PHP 8.2 or newer, you don’t need to do anything. We’re applying the update for you.

If your site runs PHP 8.1 or older, backported fixes are now available, but you should still plan to update. These versions are end-of-life, and there is no guarantee backports will be available for the next vulnerability. On Cito, we have backported this fix to PHP 5.6 and above. On cPanel, the backported fix for PHP 7.4 and above is installed.

If your site runs PHP below 7.4 on cPanel, cPanel’s own packages have no fix, and the vulnerabilities are now public. Update it now, or switch to one of CloudLinux’s PHP versions, which have the backported fix from PHP 5.2 upwards. Contact our support team if you’re unsure which applies to you.

You should:

  1. Check your site works on a newer PHP version, especially its plugins and themes. These are often prone to breakage between PHP versions.
  2. Change the version in your control panel. In cPanel, use MultiPHP Manager. In Cito, this can be changed in Site Settings.
  3. If you’re unsure how to do this, contact our support team. We can’t update your site for you, but we can offer advice on how to proceed.

If you’ve turned on session.upload_progress yourself (for example in a .user.ini, .htaccess or php.ini file), your setting may override ours. Turn it off.

If you’re on PHP 8.2, it reaches end of life on 31 December 2026 and will not receive security fixes after that date. Plan an upgrade to 8.3 or newer before then.

What happens next

Every server is now patched. We’ll update this post if anything changes. If you have questions, contact our support team.

Looking for a host that handles days like today for you? Prostack Cito is our fully managed platform. We patch it, monitor it and keep it secure, so you don’t have to. Take a look, or talk to us.

Sources