Patch PHP’s Two Critical RCE Flaws Now

Matthew Leo · Published October 23, 2026 · Guides

A web operations engineer reviews a maintenance checklist beside a laptop in a sunlit office.

Two critical flaws in PHP can allow an unauthenticated attacker to run code on a vulnerable server. The PHP project says there is no complete mitigation: updating is the only safe choice.

The October 21 security releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Google Cloud says versions from PHP 5.4 through 8.5.11 are vulnerable to CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0.

This is a runtime problem, not a flaw in WordPress, Drupal or another application. A fully updated content-management system can still be exposed if the PHP process underneath it is vulnerable.

Check the runtime that actually serves requests

Do not assume the version shown by a command-line shell is the version used by the public website. Shared hosts, control panels, containers, background workers and web servers can each point to different PHP installations.

Google says supported App Engine standard runtimes are patched automatically, but users on PHP 8.1 or earlier must upgrade and redeploy. Cloud Run users who manage their own image, and GKE users, need to rebuild and redeploy with a patched version. Its platform-specific guidance is useful even outside Google Cloud because it separates managed runtimes from customer-managed images.

Use a short, recoverable patch sequence

  1. Record the current state. Capture the runtime version, package or image source, enabled extensions, configuration path and service owner.
  2. Make a recoverable backup. Protect application data and configuration, and know how to restore them. A backup is not a substitute for patching.
  3. Deploy a fixed runtime. Use PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 as appropriate. Systems on PHP 8.1 or earlier need a supported-version upgrade because the PHP project is not issuing fixes for those branches.
  4. Restart every worker. Long-running PHP-FPM processes, queue workers and containers can keep old code in memory until they are replaced.
  5. Test real paths. Check a public page, authentication, form submission, file upload, scheduled task and any payment or email integration that matters to the site.
  6. Verify again. Confirm the version from the web-serving environment, not only from an administrator’s shell.

PHP 8.2 reaches end of life on December 31, 2026. Installing 8.2.35 closes these two flaws, but it should be treated as a bridge to a supported branch, not a long-term destination.

Do not treat a firewall rule as the fix

Both flaws involve PHP’s handling of request state and memory. A web application firewall may block a known request pattern, but the PHP project explicitly says no complete mitigation exists. Attack details can change, and not every request reaches PHP through the same control.

Reducing unnecessary exposure still matters. Mapletechie’s guide to finding internet-exposed admin consoles can help remove a separate route attackers often use after initial access. It does not replace the PHP update.

Review for signs of compromise after patching

A successful patch prevents future use of the vulnerable code; it does not erase earlier access. Review web-server, PHP-FPM, identity and cloud audit logs for unusual requests, new accounts, unexpected scheduled tasks, changed application files, unfamiliar outbound connections and new credentials.

Keep the review proportional to exposure. An internet-facing application deserves more urgency than an isolated development environment, but both still need the fixed runtime if they can process untrusted requests.

The Canadian Centre for Cyber Security has also urged organizations to update. Site owners should document the version, deployment time and verification result now; that record will be far more useful than a generic “patched” ticket if an incident has to be reconstructed later.

Tags: PHP, CVE-2026-109618, CVE-2026-109619, cybersecurity, Canada

Read on Mapletechie