Detection and mitigation of PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 – Clouding.io

On October 21, 2026, PHP released security updates to fix two critical vulnerabilities in the interpreter core, identified as CVE-2026-109618 and CVE-2026-109619. If exploited, they could allow a remote, unauthenticated attacker to execute code on a server running an affected version.

This guide explains the impact of these flaws and how to update PHP to protect your systems.

What each vulnerability does

CVE-2026-109618: memory corruption on out-of-memory (OOM) conditions. Under certain circumstances, PHP can run out of memory while it is still initializing request data. When cleaning up that request, it may then treat incomplete internal data as valid. Some multipart/form-data requests, such as those used for file uploads, can trigger this situation. PHP notes that the risk is greater with Apache mod_php, where exploitation has been demonstrated before any application code runs. PHP-FPM is also considered vulnerable, although the advisory clarifies that full exploitation through this route has not been demonstrated.
CVE-2026-109619: use of stale internal state. Part of a request’s state may remain referenced after the memory containing it has been freed. If the same worker process handles another request before that state is properly reset, PHP may reuse the stale data, which could allow code execution. One confirmed attack path involves session upload progress; for PHP 8.5, the advisory also describes a path involving fatal error backtraces. Disabling upload progress mitigates these specific paths, but it does not address every possible one.

Important

The issue lies in PHP itself, so updating WordPress, Joomla, Laravel or their extensions will not fix it on its own. You must update the interpreter that processes web requests. PHP lists the following environments as at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Versions and fixes

These vulnerabilities affect all PHP versions from 5.x onward. If you use PHP anywhere in your Clouding infrastructure, assume that you may be exposed until you apply the relevant patches.

PHP BRANCH	FIXED VERSION
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 and earlier	No patch available

Notice

Any version earlier than the fixed release for its branch is affected. PHP 8.1 and earlier no longer receive updates from the PHP project, although some distributors and LTS providers offer backported patches. If you use Ondřej Surý’s repository, updated packages are available for all branches from PHP 5.6 onward. Make sure the updated package revision is installed. Because the fix is backported, the PHP version number may remain unchanged.

Affected Clouding images

IMAGE	OS	AFFECTED VERSIONS	ACTIONS TAKEN
Plesk 18	Plesk for Linux and Plesk for Windows	Plesk Obsidian 18.0.80 Update 10 and earlier Plesk Obsidian 18.0.81 through 18.0.81 Update 3	Update Plesk to Plesk Obsidian 18.0.80 Update 11 or Plesk Obsidian 18.0.81 Update 4, as described in the official Plesk knowledge base .
HestiaCP	Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04*	All HestiaCP versions	HestiaCP uses the ondrej/php repository to provide PHP. All versions from 5.6 to 8.5 have been patched. You only need to update the repositories and install the available updates. More information is available in this thread.
CyberPanel	AlmaLinux 8, AlmaLinux 9	All CyberPanel versions	The AlmaLinux + CyberPanel images receive updates from the standard AlmaLinux repositories, so updating the repositories and installing the available updates should be sufficient. You can check which PHP versions have been patched at the following link.
pfSense	pfSense 2.x.x	2.8.1 and later	For pfSense, you need to update the packages through the web interface and upgrade to the latest PHP version. You can check which PHP versions have been patched at the following link.
Rocky Linux	Rocky Linux 8, Rocky Linux 9, Rocky Linux 10	-	As stated on the Rocky Linux forum, updates have been released for all available PHP versions (7.4 and later). More information is available in this thread and at this link.
AlmaLinux	AlmaLinux 8, AlmaLinux 9, AlmaLinux 10	-	The AlmaLinux team has published a blog post listing the patched versions. More information is available in this post.
Debian	Debian 12 and Debian 13		The Debian project has updated the PHP packages for both Bookworm and Trixie, the currently supported stable releases. Patches have also been released for Forky (testing) and Sid (unstable). For details, see DSA-6574-1 and CVE-2026-109619.
Ubuntu	Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04		Canonical has also patched the PHP versions available in each Ubuntu release. More information is available in this article on their blog.

Recommended actions

Create a snapshot before making changes

Before making changes to the server or modifying its contents, we recommend that you create a snapshot. This lets you restore the previous state if something goes wrong during the process.
Identify all PHP installations

Make an inventory of all PHP installations that handle web traffic: servers, hosting panels, containers and managed environments. For each one, check which PHP version and execution mode it uses.
Update PHP to a secure version

Update as soon as possible to the fixed package for your branch, available from PHP, your GNU/Linux distribution or the provider that manages the server.
Restart services to apply the changes

Restart PHP-FPM and the relevant web services so that no processes are left running the vulnerable version. If you use Docker, rebuild and redeploy the images that include PHP.
Protect systems that you cannot update

If you use an older branch, ask your provider whether a package with the backported patch is available or plan a migration to a supported branch. If an Internet-facing system cannot be updated, INCIBE recommends isolating it from public networks until a fixed version can be applied.
Enable server backups

If you have not yet enabled Clouding backups, we recommend enabling them to keep copies of the entire server, especially if you cannot update PHP yet. Keep in mind that backups are a complementary measure and do not replace security updates.

Temporary measures if you cannot update

PHP and INCIBE describe measures that reduce certain attack paths but do not replace the patch:

For CVE-2026-109618, PHP suggests setting memory_limit=-1 in the global PHP configuration and restarting the workers. This removes the per-request limit that an attacker could use to exhaust memory in a controlled way, but it does not prevent memory allocation failures caused by other factors and may increase resource consumption on the server. PHP also recommends limiting post_max_size (8 MB if uploads are not needed, 32 MB if they are), keeping upload_max_filesize below that value, and applying request size and complexity limits on the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA as an alternative, as they can cause the very allocation failure that triggers the vulnerable path.
For CVE-2026-109619, you can disable session.upload_progress.enabled in the global PHP configuration and restart all workers. For PHP 8.5, PHP also lists fatal_error_backtraces=0 as a mitigation for one confirmed path. These measures do not cover every path described in the advisory.

As a temporary measure, you can place the domains of your PHP websites behind Cloudflare.

If you are not using it yet, you can start with its free plan, which provides a first layer of protection. In the WAF section, enable Managed Rules and, if your plan allows it, the OWASP Core Ruleset.

It is also important to configure the server firewall to accept web connections (for example, on ports 80 and 443) only from Cloudflare IP addresses. Otherwise, an attacker could connect directly to the server and bypass Cloudflare’s protection.

Actions for cloud servers

First, check the PHP version on your cloud server:

php -v

If it is affected, update the PHP packages using the commands for your cloud server’s GNU/Linux distribution:

Debian and Ubuntu

apt update
apt install --only-upgrade 'php*'

AlmaLinux and Rocky Linux

dnf upgrade 'php*'

After updating the packages, restart PHP-FPM so that the patched version is loaded. If your repositories do not yet offer a fixed version, check the links for your distribution in the table above.

Docker containers

Many Docker images include PHP to run applications. Check whether an updated image is available for your application. If so, pull it and recreate the containers:

docker compose pull
docker compose up -d

Need help?

If you have questions about mitigating these vulnerabilities, our Support team is available to guide you. If you need expert help applying these measures on your server, our Cloud Pros can assist you through our advanced support service.

Contact Support · Learn more about Cloud Pros

References

Articles in this section