We have an update on the two recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
All of our Cloud-Hosted (SaaS) servers have now been fully patched. Patching is also complete for all cloud-hosted installations. There’s no need to open a ticket to request the update, as it will be handled for you.
To fix the critical PHP remote code execution (RCE) vulnerabilities CVE-2026-109618 and CVE-2026-109619 on your web server, follow these three simplified steps:
1. Upgrade PHP
Update your PHP installation immediately. You must upgrade to one of these safe versions:
• PHP 8.5 ➔ Upgrade to 8.5.12
• PHP 8.4 ➔ Upgrade to 8.4.27
• PHP 8.3 ➔ Upgrade to 8.3.36
• PHP 8.2 ➔ Upgrade to 8.2.35
Note: PHP 8.1 and older versions are end-of-life and will not receive official fixes. You must upgrade to a newer PHP branch.
2. Run Package Updates
If you manage PHP through a Linux package manager, run the update command for your system:
• Ubuntu / Debian:
bash sudo apt update && sudo apt upgrade
• RHEL / AlmaLinux / Rocky Linux:
bash sudo dnf upgrade
3. Restart Your Services
The fix will not take effect until you restart your web server or PHP processor:
• If using PHP-FPM: sudo systemctl restart php-fpm (or your specific version, e.g., php8.3-fpm)
• If using Apache with mod_php: sudo systemctl restart apache2
Thank you for your patience and understanding. We truly appreciate it.
The PHPKB Team
Article ID: 428
Created: October 22, 2026
Last Updated: October 22, 2026
Author: Ajay Chadha [support@phpkb.com]
Online URL: https://www.phpkb.com/kb/article/php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-update-428.html