PHP security alert 2026: Learn about critical PHP vulnerabilities, affected versions, security updates, CVE-2026-115560, and website protection steps.
Thank you for reading this post, don't forget to subscribe!PHP Security Alert 2026: Critical Vulnerabilities Put Websites at Risk — New Updates Released
PHP Security Update 2026: What Website Owners Need to Know
A major cybersecurity warning has been issued for PHP users after researchers identified two critical vulnerabilities that could allow attackers to execute malicious code on affected web servers without authentication.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026. The PHP development team released security updates to address these flaws, urging users to upgrade their installations as soon as possible.
According to security advisories published by the UK National Cyber Security Centre (NCSC) and the Canadian Centre for Cyber Security, successful exploitation could allow attackers to execute arbitrary code or access sensitive information in affected PHP processes.
The issue is particularly important for businesses, developers, hosting providers, and website administrators who rely on PHP to run web applications.
What Are the Newly Discovered PHP Vulnerabilities?
The vulnerabilities affect PHP’s internal memory management and request-processing mechanisms.
1. CVE-2026-109618: Out-of-Memory Handling Vulnerability
This vulnerability involves PHP’s handling of out-of-memory conditions. Under certain circumstances, an unsuccessful memory allocation can leave internal request data improperly initialized. Subsequent cleanup operations may then process invalid memory state.
An attacker who successfully exploits the issue may be able to execute malicious code on an affected server.
2. CVE-2026-109619: Stale Global State Vulnerability
The second vulnerability involves internal state that can continue referencing request memory after that memory has been released. Under certain conditions, subsequent processing may use this stale state before it has been correctly initialized.
Successful exploitation may also lead to remote code execution.
Both vulnerabilities have been assigned a CVSS 4.0 severity score of 9.2, classified as Critical.
Which PHP Versions Are Affected?
According to the published security advisories, the following fixed releases address CVE-2026-109618 and CVE-2026-109619:
| PHP Branch | Fixed Version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Older releases, including PHP 8.1 and earlier, are also affected but no longer receive standard security updates from the PHP project. Some operating-system vendors and commercial support providers may offer separately maintained fixes.
Administrators should consult their hosting provider or distribution vendor before deciding which package to install.
Important Additional Security Advisory
A further development was reported on October 23, 2026. The Canadian Centre for Cyber Security published an update referencing an additional vulnerability, CVE-2026-115560.
According to that advisory, this additional issue is not addressed by the October 21 security releases listed above. It requires a particular combination of PHP configuration and application behaviour.
The advisory recommends disabling the session upload progress feature until an appropriate security update is available:
session.upload_progress.enabled=0
Administrators should consult the official PHP security advisory for the latest technical guidance and verify whether their applications are affected before applying configuration changes.
How Can Website Owners Protect Their PHP Applications?
Website administrators should take the following steps to reduce their exposure to these security issues.
- Identify PHP installations: Check all servers, containers, hosting accounts, and applications that use PHP.
- Install the appropriate security updates: Upgrade to the fixed release for the relevant PHP branch and verify the vendor’s instructions.
- Prioritise internet-facing servers: Publicly accessible web applications should receive immediate attention.
- Review additional security advisories: Check the latest guidance for CVE-2026-115560 and apply the recommended mitigation if relevant.
- Inspect logs for suspicious activity: Look for unusual requests, unexpected processes, unfamiliar files, or unexplained outbound connections.
- Back up important data: Maintain verified backups before performing maintenance or upgrading production systems.
- Confirm the result: Check the installed PHP version and test the website after updating.
If a system cannot be updated or adequately protected, administrators should follow the relevant security authority’s guidance on isolation and incident investigation.
Why Is This PHP Security News Important?
PHP is widely used for server-side web development, including content management systems, online stores, business applications, and custom websites.
A vulnerability in the PHP runtime can affect more than a single website because multiple applications may depend on the same server environment. A successful attack could compromise application data, disrupt services, or provide an attacker with access to server-side functionality.
For this reason, keeping PHP installations supported and patched is an essential part of website security.
Conclusion
The PHP security disclosures published in October 2026 highlight the importance of maintaining updated web infrastructure. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been addressed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
However, the additional advisory concerning CVE-2026-115560 means administrators should not assume that installing the October 21 releases resolves every related PHP security issue.
Website owners should review the official advisories, update affected installations, assess their configuration, and monitor their systems for suspicious activity.
Editorial disclaimer: This article is based on published security advisories available as of October 24, 2026. Security recommendations may change as new information becomes available. Verify the latest guidance before making changes to production systems.
Recommended Heading Structure
H1: PHP Security Alert 2026: Critical Vulnerabilities Put Websites at Risk
H2: What Are the Newly Discovered PHP Vulnerabilities?
H3: CVE-2026-109618: Out-of-Memory Handling Vulnerability
H3: CVE-2026-109619: Stale Global State Vulnerability
H2: Which PHP Versions Are Affected?
H2: Important Additional Security Advisory
H2: How Can Website Owners Protect Their PHP Applications?
H2: Why Is This PHP Security News Important?
H2: Conclusion
Verified News Sources
Use these links as the primary references for the article.
1. Official PHP Website — Security Releases
PHP’s official website announced PHP 8.5.12 and the corresponding security releases on October 21, 2026.
2. UK National Cyber Security Centre (NCSC)
Official guidance explaining the vulnerabilities, their potential impact, and recommended security actions.
https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
3. Canadian Centre for Cyber Security
Security alert updated October 23, 2026, including affected versions, fixed releases, and the additional CVE-2026-115560 advisory.
4. Google Cloud Security Blog
Technical explanation of CVE-2026-109618 and CVE-2026-109619, their severity, and remediation guidance.
5. Official PHP Security Advisory on GitHub
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Publishing recommendation: Use the official PHP security advisory as the primary source, link to the NCSC and Canadian Cyber Centre for independent confirmation, and verify the latest advisory status immediately before publishing.
