Home / Guides / PHP critical update
Security notice · October 2026The PHP project has released fixes for two critical remote code execution bugs. Websites that run PHP should update to a fixed version as soon as their vendor offers it.
On 21 October 2026 the PHP project published a security advisory about two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without logging in. The project says all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that the risk is highest for mod_php.
This page is a plain-language summary. The original text is the source: PHP news archive on php.net. Read it for the full technical details, because the facts may be updated.
Your site may use a different PHP than the server default.
Run php -v in a terminal. Note that a server can have several PHP versions, so check the one your websites use.
In WHM, open MultiPHP Manager to see the PHP version of each domain. EasyApache 4 packages are named ea-php followed by the version, for example ea-php83.
Open Tools and Settings, then PHP Settings, to see the installed versions.
Run php -v from the PHP folder that IIS uses, or look at a phpinfo page that only you can reach.
In the dashboard open Tools, then Site Health, then Info, then Server, to see the PHP version.
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Run apt update, then apt list --upgradable and look for php packages. Install the update when your distribution publishes the fixed version, then restart PHP-FPM or Apache.
Run dnf check-update for php packages, install the fixed version when it appears, then restart PHP-FPM or Apache.
Update the ea-php packages from WHM or with the package manager when cPanel publishes the fixed builds, then rebuild and restart.
The PHP project says the volunteer-run Remi repository will not have updates on the first day. Switch to your distribution packages or build from source if you need the fix at once.
These versions are not supported by the PHP project. Ask your distribution or LTS vendor for a backported fix, or move to a supported version.
Vendors publish fixed packages at different times. If your vendor has no update yet, ask them for a date.
The PHP project says these settings reduce exposure to some attack paths. They do not make an installation safe. Only the update does.
If PHP is installed but no website uses it, stopping the PHP-FPM service until the update is available removes the exposure.
If your server runs PHP (WordPress, Laravel, cPanel hosting and many others), yes, unless it already runs a fixed version. The PHP project says every PHP setup that serves web requests is at risk.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project.
Ask them which PHP version your site runs and when the fixed version will be installed. On shared hosting you cannot update PHP yourself.
Not completely. The PHP project lists settings that reduce the risk for some attack paths, but says only an update is a complete solution.
On php.net, in the 2026 news archive. We link it on this page. Please read the original, because details can change.
Send us the server details and we will tell you what we see. The 15-minute check is free.