Last Updated: 22 October 2026

 

Security Alert: Critical Vulnerabilities in PHP

Two critical security vulnerabilities have been identified in the PHP programming language, which powers millions of websites and web applications. The PHP development team released security updates on 21 October 2026 to address CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities, collectively referred to as PHP2Shell in some security advisories, could allow an unauthenticated attacker to execute malicious code remotely on an affected server. Exploitation may also expose sensitive information accessible to the PHP process. Both vulnerabilities have a CVSS v4.0 severity score of 9.2, indicating a critical security risk.

 

For businesses, developers, and VPS administrators, these vulnerabilities highlight the importance of keeping server software updated. An unpatched PHP installation could put hosted websites, application data, and server operations at risk. 444 Hosting recommends that website owners and server administrators review their PHP environments and apply the appropriate security updates as soon as possible.

 

Technical Overview of the Vulnerabilities

The vulnerabilities originate from memory-management problems within the PHP runtime. They are not limited to a particular content management system or website framework.

 

1. CVE-2026-109618 — Remote Code Execution Through Out-of-Memory Corruption

This vulnerability involves the way PHP handles an out-of-memory (OOM) condition during request processing. Under certain circumstances, PHP may interrupt request processing while internal request data is only partially initialized. During subsequent cleanup, the runtime may incorrectly treat this incomplete data as valid. An attacker may exploit this behavior to cause memory corruption and potentially execute arbitrary code on the affected server.

 

2. CVE-2026-109619 — Remote Code Execution Through Stale Global State

This vulnerability occurs when internal request-related state remains accessible after the memory supporting it has been released. A later request handled by the same PHP worker may access this stale state before the runtime properly resets it. Under the right conditions, this can create an opportunity for remote code execution. Both vulnerabilities affect the PHP runtime itself. As a result, updating a website's CMS, theme, or plugin alone does not resolve the underlying issue.

 

Which Websites and Servers Are at Risk?

Any vulnerable PHP installation that serves web requests should be assessed and updated. Potentially affected environments include:

  • WordPress websites and other PHP-based content management systems.
  • Custom-developed websites and applications built with PHP frameworks.
  • PHP applications running on Linux or Windows VPS servers.
  • Dedicated servers and shared web hosting environments.
  • Servers using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.
  • Containerized applications and third-party software that bundle their own PHP runtime.

The PHP development team identifies Apache with mod_php as a particularly high-risk configuration because a demonstrated exploit can trigger the vulnerability before application-level code runs. However, administrators should not assume that other PHP handlers are safe. All PHP installations serving web requests should be identified and assessed.

 

Affected PHP Versions and Security Updates

The official PHP development team has released patched versions for the following supported branches.

PHP Version Affected Versions First Fixed Release
PHP 8.5 8.5.0–8.5.11 8.5.12
PHP 8.4 8.4.0–8.4.26 8.4.27
PHP 8.3 8.3.0–8.3.35 8.3.36
PHP 8.2 8.2.0–8.2.34 8.2.35

 

Important: PHP 8.1 and older versions are no longer covered by the PHP project's regular security release programmed. Some operating system distributions, extended-support providers, and vendor-maintained packages may supply backported security fixes. The PHP project has also published limited source backports for selected older branches.

 

If your server uses an older PHP version, do not assume it is protected based on the version number alone. Check the applicable vendor advisory and confirm that the specific installed package or build contains the security fix. For the original release announcement and technical guidance, refer to the official PHP security advisory.

 

How VPS Administrators Should Respond

VPS environments often provide greater control over server software, but this also means administrators must ensure that the installed components remain secure. The following actions are recommended.

 

1. Identify Every PHP Installation

Check all PHP versions installed on your VPS, including those used by individual websites, subdomains, background jobs, and containers. A server may run several PHP branches simultaneously. Updating one installation does not automatically mean that every other installation is protected. Priorities internet-facing services and systems that process requests from untrusted sources.

 

2. Apply the Appropriate Security Patches

Upgrade vulnerable PHP installations to the relevant fixed release or install the appropriate security-patched package provided by your operating system or hosting control panel vendor. If PHP was installed using a third-party repository, custom build, or container image, verify that the package source has published an applicable fix. After updating, restart the relevant PHP services or redeploy the application where required so that the patched runtime is actively used.

 

3. Check the Hosting Control Panel

If your VPS uses cPanel & WHM or Plesk, verify that both the PHP packages and the relevant control panel components have received their security updates. Control panels may maintain their own PHP packages and build versions. A standard operating system update or a change to the PHP version selected for a website may not update every affected component. Follow the platform-specific guidance in the sections below.

 

4. Review Unsupported PHP Branches

Applications running older PHP versions should receive particular attention. Where possible, upgrade to a supported PHP branch after checking application compatibility. If an older PHP release is required, confirm that a security-maintained package is available and that the appropriate fix has been installed. Do not continue running an exposed, vulnerable PHP service simply because the application still works correctly.

 

5. Inspect Logs and Monitor Server Activity

Applying a security patch protects against the vulnerabilities addressed by that patch, but it does not automatically remove malicious changes that may have occurred before the update. Review relevant web server logs, PHP logs, authentication records, and system activity for suspicious requests, unexpected processes, unauthorized file changes, or unusual outbound connections. If compromise is suspected, investigate the incident and follow an appropriate recovery process. Patching should be part of the response, not the only action taken.

 

6. Maintain Backups and Validate Applications

Before significant server changes, ensure that recent backups of website files, databases, and important configurations are available. After updating PHP, test website functionality and monitor the application for errors. This helps confirm that the security update has been applied without introducing unexpected compatibility issues.

 

cPanel & WHM: Required Security Updates

cPanel has published security updates for cPanel & WHM and its EasyApache 4 PHP packages. The current cPanel advisory lists the following patched releases for its standard EasyApache 4 packages:

Package Patched Version
ea-php74 7.4.33-19
ea-php80 8.0.30-12
ea-php81 8.1.34-5
ea-php82 8.2.35
ea-php83 8.3.36
ea-php84 8.4.27
ea-php85 8.5.12

 

The corresponding CloudLinux EasyApache packages may use different build numbers. The cPanel advisory also specifies patched versions of cPanel & WHM itself. Administrators should check the applicable versions for their environment and follow the official update procedure rather than relying only on the PHP version displayed in the hosting interface. 

 

Read the full instructions here:  cPanel – Critical PHP Security Release: CVE-2026-109618 and CVE-2026-109619

 

Plesk: Update PHP Packages and Control Panel Components

Plesk has published a security advisory covering the affected PHP packages shipped with Plesk Obsidian, as well as the PHP components used internally by the control panel. For the main PHP branches, the patched versions are:

PHP Branch Patched Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

 

Plesk for Linux also lists patched builds for selected older PHP branches, including PHP 7.4, 8.0, and 8.1. These builds retain their existing PHP version numbers, so the build date is important when checking whether the fix is present. The advisory also identifies patched Plesk Obsidian updates for its internal PHP engine components:

  • Plesk Obsidian 18.0.81 Update 4.
  • Plesk Obsidian 18.0.80 Update 11.

Administrators should check the latest Plesk advisory for their operating system, update the relevant PHP packages, and ensure that the control panel itself is running a patched version.

Read the complete instructions here:  Plesk – PHP2Shell: Remote Code Execution in PHP Shipped with Plesk

 

What If Immediate Patching Is Not Possible?

Applying an appropriate security update is the recommended solution. According to the PHP security advisory, temporary configuration changes may reduce exposure to specific attack paths, but they do not make an unpatched installation fully safe. If you cannot update immediately:

  • Review the temporary mitigation guidance in the official PHP advisory.
  • Priorities internet-facing applications and assess whether vulnerable services can be isolated.
  • Consider taking an affected system offline if it cannot be secured promptly.
  • Investigate potential compromise if the system may have been exposed before remediation.

Temporary measures should not be treated as a permanent alternative to patching. Further recommendations are available from the  UK National Cyber Security Centre .

 

What Should Shared Hosting Customers Do?

If your website is hosted on a shared hosting service, you may not have permission to update the underlying PHP packages yourself. Check whether your hosting provider has applied the required server-level security updates. If you are unsure, contact the provider and ask whether the PHP runtime used by your website has been patched for CVE-2026-109618 and CVE-2026-109619.

 

Selecting a different PHP version in a hosting control panel is not, by itself, proof that the vulnerability has been resolved. The installed runtime and its package build must contain the appropriate security fix. Website owners should also maintain updated CMS software, themes, plugins, and application dependencies as part of their regular security practices.

 

Final Thoughts

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities that can expose affected PHP applications to unauthenticated remote code execution and other security risks. The PHP development team has released fixes for PHP 8.2, 8.3, 8.4, and 8.5. Hosting control panels have also published platform-specific security updates, including patched package builds for certain older PHP branches.

 

VPS owners, web hosting administrators, developers, and website owners should identify their PHP installations, follow the relevant vendor instructions, and verify that the required updates have been applied. At 444 Hosting, we encourage customers and server administrators to treat security maintenance as an essential part of operating reliable hosting infrastructure. Keeping server software updated, monitoring for suspicious activity, and maintaining reliable backups all contribute to a stronger security posture. 

 

For detailed technical instructions, consult the official advisories listed below.