On 21 October 2026, the PHP security team released fixes for two critical vulnerabilities that let attackers take over a web server without logging in. Both are rated 9.2 out of 10. The flaws sit inside PHP itself, so they affect almost every PHP website, from WordPress and WooCommerce stores to Laravel apps and custom builds. The technical details are already public, and the only real fix is updating PHP.
What you need to know
- No access required. An attacker doesn’t need an account, a password or any foothold on your site to run their own code on your server.
- It’s PHP, not your plugins. Updating your CMS, theme or plugins won’t help. PHP itself has to be patched.
- Time is short. The details are public, working exploits are expected within hours, and attack traffic was seen before the fix was even released.
- Old versions are the biggest risk. PHP 8.1 and older are end-of-life. They get no official release, and some platforms won’t patch versions below 7.4 at all.
- Workarounds only buy time. Firewall rules and disabled features reduce exposure, but there is no complete mitigation. Patching is the only safe choice.
The problem
Two memory-safety bugs in how PHP starts and finishes each web request can let a stranger run code on your server. Because they live in PHP’s core, every site running PHP should be treated as vulnerable until it’s patched, whatever CMS, framework or plugins it uses.
Bug one: crashing PHP mid-setup (CVE-2026-109618)
When PHP runs out of memory, it stops abruptly. If that happens while a request is only half set up, the cleanup code that runs afterwards can act on incomplete data. An attacker can trigger this on purpose with a crafted upload that stays inside PHP’s normal limits, for example a request with no usable content length or a form with huge numbers of headers.
Bug two: leftovers from the last visitor (CVE-2026-109619)
A single PHP worker handles many requests in a row. Some internal data from one request can survive into the next after its memory has been freed, and a later request can use it before PHP resets. The confirmed attack routes are PHP’s session upload progress feature and, on PHP 8.5 only, fatal error backtraces.
Which servers are most exposed
Server setup | Exposure |
Apache with mod_php | Highest. A working exploit has been shown with default settings, before any site code runs. |
PHP-FPM | Less exposed to bug one, but bug two has been exploited against it. |
LiteSpeed LSAPI | Likely vulnerable, not yet confirmed. |
Why it's urgent
The technical details are now public, so working exploits are expected within hours. Cloudflare reported seeing attack traffic before the official fix was released, and attackers are already changing their methods to slip past firewall rules
The solution
Update PHP to a patched version. The PHP team is clear that there are no complete mitigations, so updating is the only safe choice.
Patched versions
re are no complete mitigations, so updating is the only safe choice.
Patched versions
If your site runs PHP 8.2 or newer on a managed host, your provider may already be rolling out these updates. It’s worth confirming with them rather than assuming.
If you're on PHP 8.1 or older
Versions below 8.2 are end-of-life and don’t get a normal release. The PHP team published minimal source patches for 7.4, 8.0 and 8.1, but whether a patched package reaches your server depends on your host or vendor. On cPanel, fixes are being backported only from PHP 7.4 upwards, so anything older must be upgraded. Even where a backport exists, there’s no guarantee the next one will.
Your checklist
- Test your site on a newer PHP version. Check plugins and themes first, since they’re the most likely to break between versions.
- Switch PHP versions in your control panel. In cPanel, use MultiPHP Manager.
- Check your session settings. If you turned on
session.upload_progressorsession.auto_startyourself in a.user.ini,.htaccessorphp.inifile, turn them off. If your site needs a session, callsession_start()in your code where it’s required.
What about workarounds?
- Test your site on a newer PHP version. Check plugins and themes first, since they’re the most likely to break between versions.
- Switch PHP versions in your control panel. In cPanel, use MultiPHP Manager.
- Disabling
session.upload_progressblocks one confirmed route for the second bug and is worth keeping off if you don’t need it. It does nothing against the first bug, so treat it as a precaution, not a fix. Other interim options, like removing PHP’s memory limit or capping request sizes, reduce exposure but can break uploads.
If you use Cloudflare
- Cloudflare has deployed firewall rules for the known attack methods on every plan, including Free, but only for traffic that runs through its proxy. Cloudflare calls these a stopgap, and attackers are already adapting. If you’re on a paid plan, make sure the Cloudflare Managed Ruleset is deployed in block mode.
Plan ahead for PHP 8.2
Need a hand?
Not sure which PHP version your site runs, or worried an upgrade will break something? Get in touch with Innovate Media and we’ll help you work out your next step.
Source
This post is based on the advisory published by Prostack: Critical PHP Security Update, October 2026, updated 21 October 2026.