Urgent security alert - 21 October 2026

Patch your website's PHP immediately.

Two critical vulnerabilities in PHP allow an unauthenticated attacker to execute code on servers running PHP. If your website runs on PHP - including most WordPress sites - it is imperative that you update now.

Call 1300 477 814 Speak to us for details
What happened

Fixed PHP versions were released today

The PHP project released security updates that fix two critical remote code execution vulnerabilities. Any server running an older version should be updated to one of these releases straight away:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

If your site runs a PHP version older than 8.2, it no longer receives security fixes and should be upgraded to a supported version.

The vulnerabilities

Two related critical remote code execution flaws

CVE-2026-109618 / GHSA-w8hw-w9fx-j79w

RCE via OOM corruption (out-of-memory)

If a request reached PHP's memory_limit at exactly the wrong moment, PHP could leave partially initialised internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp

RCE via stale state

A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

Why this is so serious

Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. An attacker does not need a login or password. A successful attack can give them control of your web server - your website, your customer data and anything else on that server.

How we can help

Two ways CX IT Services can fix this for you

01

We patch it for you

Give us access to your hosting or server and our engineers will check your PHP version, apply the update and confirm your website still works properly afterwards.

02

We take over managing your site

Move your website to be managed by us. We keep PHP and your site patched, monitored and backed up, so the next critical update is handled before you even hear about it.

Not sure if your website is affected?

Speak to us today. We will tell you which PHP version your site is running and what needs to happen next.

Call 1300 477 814 Email [email protected]

Source: The PHP Foundation - Today's PHP Security Release, and How We're Strengthening PHP Security