Critical PHP RCE Flaws: Which Versions Need an Urgent Update?

Two critical vulnerabilities in the PHP runtime have prompted emergency security releases on October 21, 2026. The PHP development team warns that the flaws can enable unauthenticated remote code execution under affected conditions, making this an infrastructure update rather than an ordinary application-level bug fix.

The official PHP security advisory and release notice identifies CVE-2026-109618 and CVE-2026-109619. It recommends updating immediately and stresses that configuration workarounds do not provide complete protection. Organizations running PHP-powered websites, applications, content-management systems or internal tools should treat the security advisories as the source of truth for their particular deployment.

Which PHP versions include the security fixes?

The project lists these updated release targets for its supported branches:

• PHP 8.5: update to 8.5.12.
• PHP 8.4: update to 8.4.27.
• PHP 8.3: update to 8.3.36.
• PHP 8.2: update to 8.2.35.

A bare major-version check is insufficient. For example, a server reporting PHP 8.4 is not confirmed patched until the installed package incorporates the fix. A Linux distribution may backport a fix while retaining its own package version, so administrators using vendor packages should check the vendor's advisory rather than assume upstream numbering applies verbatim.

What about PHP 8.1 and older deployments?

PHP says 8.1 and older no longer receive routine project updates. Some distribution and long-term-support vendors can supply backported packages. The PHP security team has also published minimal source backports for selected older branches, including 7.4, 8.0 and 8.1, for operators who build PHP themselves.

That does not turn an unsupported runtime into a fully supported product. A legacy application may also face unrelated unpatched bugs, obsolete extensions and unmaintained dependencies. Administrators should treat emergency vendor fixes as part of an upgrade plan, not as a reason to freeze the stack indefinitely.

What are CVE-2026-109618 and CVE-2026-109619?

The two issues occur inside PHP itself, according to the maintainer notice, rather than requiring a specific vulnerable WordPress plugin or third-party PHP library.

CVE-2026-109618 concerns memory handling during out-of-memory conditions: interrupted initialization can leave internal request data in a state that later cleanup handles incorrectly. CVE-2026-109619 concerns stale request-owned global state after its supporting memory has been released.

A public website running on a popular framework is therefore not automatically exempt simply because its application code has been audited. Risk depends on the runtime, configuration, exposure and patch level.

The PHP team calls out installations serving web requests through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php particularly concerning because researchers demonstrated a path that can begin before application code executes. Consult the first-party advisory for precise applicability.

Where artificial intelligence fits into the discovery

The disclosure has also become a noteworthy AI-security story. OpenAI's Patch the Planet update describes coordinated work with PHP maintainers, Wiz, Cloudflare and other partners. OpenAI says AI-assisted research helped identify one critical issue, while Wiz independently reported both vulnerabilities.

Wiz's technical disclosure describes the flaws under the name PHP2Shell and argues that modern AI systems lowered the effort needed to discover and validate complex exploitation paths. Those findings illustrate a dual-use security challenge: similar tools can accelerate defensive audits and patch preparation, but can also make research easier for attackers.

The immediate user action remains mundane and essential: get verified, patched binaries running on every affected server.

A practical patching checklist for site operators

Before deploying changes, inventory every place PHP might run, not only the version on a developer's laptop. Production hosts, background workers, containers and older staging images may differ.

• Check the deployed runtime: inspect the PHP version and its package origin across production systems. For containerized deployments, verify the image actually used by running pods.
• Follow your distribution or hosting provider's advisory: an upstream version and a vendor backport may use different package identifiers.
• Apply the relevant security update: rebuild container images, roll out packages, then restart PHP workers and web services as required by the platform.
• Verify after deployment: confirm running processes use the updated binary and monitor errors, uptime and security telemetry.
• Escalate unsupported versions: use vendor-backed fixes where available and prioritize migration to a supported PHP branch.

The official advisory discusses short-term mitigations for specific paths, but explicitly warns they do not make a vulnerable installation safe. Changing configuration alone should not be represented as a replacement for installing patches.

Are WordPress and Symfony sites affected?

Those applications run on PHP, so their exposure can depend on the PHP engine beneath them, not merely the application's own version. A WordPress, Laravel, Drupal or Symfony update alone does not guarantee that a vulnerable PHP runtime has changed. The correct check is the installed PHP engine and your infrastructure vendor's current security guidance.

This distinction is useful for managed-hosting customers: ask the provider for the runtime patch status rather than only whether a CMS or plugin has been updated.

For ongoing developer and infrastructure coverage, see GameLog News technology reports. The PHP project's 2026 release archive remains the authoritative place to confirm security notices and corrected versions.

Bottom line: the fix is available for PHP's supported 8.2–8.5 branches, but existing servers are not necessarily upgraded automatically. Inventory, apply vendor-appropriate patches and verify the live runtime before considering the incident addressed.