Patch PHP’s Critical Remote Code Execution Vulnerabilities

October 22, 2026 • 4 min read

PHP’s security release is out. On October 21, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical vulnerabilities that can allow unauthenticated remote code execution. Both are rated CVSS v4.0 9.2.

If you read Prepare for PHP’s Critical Security Release, you already know where your PHP updates come from. Now the update has to be installed, and every long-running PHP process restarted, before your server is actually patched.

Let’s look at what the two flaws are, and then how to patch a Laravel server and restart everything that still runs the old PHP.

What the two flaws are #

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): if PHP runs out of memory while it’s setting up a request, the cleanup that follows can treat half-initialized data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): state that belongs to one request can survive after its memory is freed, and a later request on the same worker can use it.

PHP says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php the highest risk, with a demonstrated exploit that runs before any application code does.

Patching on Forge #

Forge’s automatic security updates don’t patch PHP. Forge installs PHP from Ondřej Surý’s packages, and Ubuntu’s unattended upgrades only apply updates from Ubuntu’s own security repository.

So update each server yourself. On the server’s PHP tab, open the menu next to each installed version and click Update PHP X.X. Do it for every version on the server, including ones no site uses. Forge’s guide also has the SSH commands, and an API option if you have many servers.

The patched packages didn’t reach Forge’s package source the moment PHP released them, which Forge’s guide warns about. By the morning of October 22 they had, for Ubuntu 22.04 and 24.04. Before updating, apt-cache policy php8.4-fpm should show the fixed version as the Candidate.

On a server that uses Ubuntu’s own PHP packages, the fix comes as a backport, so php -v won’t change. Ubuntu 24.04’s php8.3 is fixed in 8.3.6-0ubuntu0.24.04.13, and the package changelog lists both CVEs:

zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php8.3-fpm/changelog.Debian.gz

If you build on a PHP Docker image, rebuild with --pull so the updated base image is used, then recreate the containers.

Restarting everything that runs PHP #

Updating the package restarts PHP-FPM. Every other process that runs PHP keeps the old version in memory until it restarts:

• Queue workers: php artisan queue:restart
• Horizon: php artisan horizon:terminate
• Reverb and other daemons: restart them in your process manager

Octane needs more than octane:reload. That command only replaces the workers, and with Swoole the new workers are forked from a master process that’s still running the old PHP. Restart the Octane process itself.

If you run Octane with FrankenPHP, the frankenphp binary Octane downloaded has PHP built in, so updating your system’s PHP doesn’t change it. FrankenPHP 1.13.2 is the release built with the fixed PHP.

Then check the versions. On Forge, php8.4 -v and php-fpm8.4 -v should both show the fixed version, for each PHP version on the server.

PHP 8.1 and older #

PHP isn’t releasing fixes for 8.1 or older. Because of how severe these are, it did publish minimal source backports for 7.4, 8.0 and 8.1, for people who build PHP themselves.

Distributions may patch their own older versions. Ubuntu 22.04’s php8.1 is fixed in 8.1.2-1ubuntu2.28. Otherwise the fix is upgrading. PHP 8.2’s security support ends on December 31, 2026, so aim for 8.4 or 8.5.

A known issue on 8.4.27 and 8.5.12 #

8.4.27 and 8.5.12 introduced a crash during garbage collection of SimpleXML objects, which shows up as zend_mm_heap corrupted. It’s tracked in php-src #24488. 8.3.36 and 8.2.35 don’t include the change that caused it.

That’s not a reason to stay on a vulnerable version. If your app parses XML, keep an eye on your logs after updating.

Also this week: Laravel’s own advisory #

On October 19, Laravel published its own critical advisory, an authentication bypass in the token guard (CVE-2026-114509). It’s fixed in Laravel 13.29.0 and 12.68.0, so run composer update laravel/framework while you’re patching.

So update every PHP version on the server, restart everything that runs PHP, and check the versions before you call it done.

Every Forge server patched this week got its PHP from Ondřej Surý, who maintains these packages for Debian and Ubuntu. If they got you patched, consider sponsoring him.