Skip to content
Daryl Legion

Prepare for PHP’s Critical Security Release

October 21, 2026 • 3 min read

If you run PHP in production, the PHP security team wants you ready to update today. On October 20 it gave advance notice of a security release scheduled for Wednesday, October 21 at 14:00 UTC:

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

PHP doesn’t normally warn anyone before a security release.

Let’s look at what PHP has confirmed and what has only been reported, and then what to have ready before 14:00 UTC.

What PHP has confirmed

The notice gives the date, the time and the severity. Everything else is held back until the release: “Full details, affected versions, and the fixed versions will be published with the release.”

The release could also come early:

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

What has been reported

Some details have come out ahead of the release. watchTowr told BleepingComputer that both are remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619. It believes they affect every major version from PHP 5 to PHP 8. Its CEO, Benjamin Harris, said the two flaws “have been leaked” ahead of a planned disclosure. watchTowr rates both CVSS 10 rather than PHP’s 9.2, believes it has reproduced one of them, and hasn’t seen either exploited in the wild.

PHP hasn’t confirmed the vulnerability type, the CVE ids or the affected versions yet.

Which versions will get a fix

PHP only ships releases for the versions it still supports. Under its support policy, that’s PHP 8.2, 8.3, 8.4 and 8.5. PHP 8.1 reached end of life on December 31, 2025. PHP release manager Ben Ramsey confirmed that the project is only releasing patches for those four versions, and that distributions might backport them to older ones.

Some Linux distributions keep patching versions PHP no longer supports, on their own schedule. Ubuntu 22.04 ships PHP 8.1 and still publishes security updates for it, most recently on October 19.

Before 14:00 UTC

  • Find out which PHP version you run and where its updates come from. It could be your distribution’s packages, a PPA, a Docker base image or your host. That decides when the fix reaches you.
  • Check for the CVE ids once they’re published. Ubuntu backports fixes without changing the version number, so php -v on Ubuntu 24.04 shows PHP 8.3.6 before and after a security update. The package changelog in /usr/share/doc lists the CVEs each update fixes.
  • Restart everything that runs PHP after updating. The PHP-FPM package restarts PHP-FPM, but queue workers and Horizon keep running the old PHP until they restart. Run php artisan queue:restart or php artisan horizon:terminate, and your process manager will start them again on the new version.

So work out now where your PHP update will come from, and restart your workers once it’s installed.

If you’re on PHP 8.1 or older and your distribution doesn’t patch it, the only fix PHP supports is upgrading to PHP 8.2 or newer.