What versions of PHP fix CVE-2026-109618 and CVE-2026-109619?

Affected PHP versions and first fixed releases: PHP 8.5 (affected 8.5.0-8.5.11, first fixed: 8.5.12); PHP 8.4 (affected 8.4.0-8.4.26, first fixed: 8.4.27); PHP 8.3 (affected 8.3.0-8.3.35, first fixed: 8.3.36); PHP 8.2 (affected 8.2.0-8.2.34, first fixed: 8.2.35); PHP 5.4-8.1 (No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required).

Does updating PHP cause web application downtime?

When properly executed with PHP-FPM, updates can be performed with zero downtime by gracefully reloading the service (systemctl reload php-fpm) rather than hard stopping it.

What if I cannot update PHP immediately?

You can mitigate CVE-2026-109619 immediately by configuring pm.max_requests = 250 in your PHP-FPM pool configuration. This forces worker recycling before cross-request session leakage can occur.

Remediation & Patching Manual

How to Fix PHP2Shell (CVE-2026-109618 & CVE-2026-109619)

On October 21–22, 2026, the PHP development team released emergency security updates addressing two critical unauthenticated remote code execution (RCE) flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Follow our verified zero-downtime patching guide to upgrade to the latest official releases across Ubuntu, Debian, RHEL, AlmaLinux, Docker, and control panels.

Scan Your Server First

Official Patched PHP Versions Matrix

The PHP Security Team released official point releases addressing both CVE-2026-109618 and CVE-2026-109619. Verify your active PHP branch against the official resolution matrix:

PHP Branch	Affected Versions	First Fixed Version	Remediation Status
PHP 8.5	8.5.0 – 8.5.11	8.5.12	Official release available
PHP 8.4	8.4.0 – 8.4.26	8.4.27	Official release available
PHP 8.3	8.3.0 – 8.3.35	8.3.36	Official release available
PHP 8.2	8.2.0 – 8.2.34	8.2.35	Official release available
PHP 5.4 – 8.1	5.4.0 – 8.1.31 (All versions)	No upstream fix released	End-of-life and have no planned fix · Migration to a supported branch is required

Authoritative Threat Intelligence & Industry Citations

The PHP development team released emergency security updates on October 21–22, 2026, to fix two critical unauthenticated remote code execution (RCE) vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Review the official threat reports and sysadmin advisories:

Operating System Patching Commands

Execute the commands below based on your server's Linux distribution or deployment model:

Debian / Ubuntu LTS

APT Package Upgrade (Ondřej Surý PPA)

Update repository metadata and upgrade installed PHP-FPM and CLI binary packages without replacing unrelated packages:

# 1. Update package index
sudo apt-get update

# 2. Upgrade to latest PHP 8.5 (First fixed version: 8.5.12)
sudo apt-get --only-upgrade install php8.5-fpm php8.5-cli php8.5-common php8.5-opcache

# Or for PHP 8.4 (8.4.27+) / PHP 8.3 (8.3.36+) / PHP 8.2 (8.2.35+):
sudo apt-get --only-upgrade install php8.4-fpm php8.4-cli php8.4-common php8.4-opcache
sudo apt-get --only-upgrade install php8.3-fpm php8.3-cli php8.3-common php8.3-opcache
sudo apt-get --only-upgrade install php8.2-fpm php8.2-cli php8.2-common php8.2-opcache

# 3. Reload PHP-FPM service (zero-downtime)
sudo systemctl reload php8.5-fpm # (or php8.4-fpm / php8.3-fpm / php8.2-fpm)
sudo systemctl reload nginx
          

RHEL / AlmaLinux / Rocky

DNF / YUM Upgrade (Remi Repository)

Purge DNF package caches and update the active PHP module stream:

# 1. Clean repository metadata
sudo dnf clean all

# 2. Update to latest PHP 8.5 (or remi-8.4 / remi-8.3 / remi-8.2)
sudo dnf module update php:remi-8.5
sudo dnf upgrade "php*"

# 3. Gracefully reload PHP-FPM service
sudo systemctl reload php-fpm
sudo systemctl reload nginx
          

Docker & Kubernetes

Container Base Image Rebuild

Ensure your Dockerfile pulls patched upstream images and rebuild without caching:

# In your Dockerfile: Pull latest official patched release
# Latest PHP 8.5:
FROM php:8.5.12-fpm-alpine
# Or for PHP 8.4 / 8.3 / 8.2:
FROM php:8.4.27-fpm-alpine
FROM php:8.3.36-fpm-alpine
FROM php:8.2.35-fpm-alpine

# Rebuild container with fresh layers:
docker compose build --no-cache app
docker compose up -d --force-recreate app
          

Hosting Panels

cPanel / WHM & Plesk Updaters

Update managed PHP packages through official control panel updaters:

# cPanel / EasyApache 4 CLI:
yum clean all && yum update "ea-php82*" "ea-php83*" "ea-php84*" "ea-php85*"
/scripts/restartsrv_apache_php_fpm

# Plesk Obsidian CLI:
plesk installer update --packages
plesk bin php_settings --re-read
          

Emergency Workaround: PHP-FPM Pool Lifecycle Hardening

If immediate binary package upgrading cannot be performed due to change-freeze windows or legacy extension compilation constraints, apply these configuration hardening rules immediately to neutralize CVE-2026-109619:

1. Limit PHP-FPM Worker Lifecycle (pm.max_requests)

CVE-2026-109619 exploits persistent worker memory reuse. By configuring pm.max_requests = 250, each PHP-FPM child process terminates and returns memory to the OS after serving 250 requests, preventing cross-request token contamination:

; Edit your pool file: /etc/php/8.x/fpm/pool.d/www.conf
pm = dynamic
pm.max_requests = 250
pm.process_idle_timeout = 10s

; Apply without stopping active traffic:
sudo systemctl reload php8.3-fpm
        

2. Cloak PHP Identification Headers (expose_php = Off)

Prevent automated scanners from identifying your exact PHP patch level:

; Edit /etc/php/8.x/fpm/php.ini and /etc/php/8.x/cli/php.ini
expose_php = Off
        

Verification & Post-Patch Audit

After applying package upgrades and configuration changes, run these verification checks:

1. Verify CLI & FPM Version Output

Run php -v and php-fpm8.3 -v in your terminal. Confirm that your patch version is PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+.

2. Test Target Domain with Free Security Scan

Enter your domain below to perform an automated non-destructive verification scan against our engine:

3. Validate Web Server HTTP Headers

Execute curl -I https://yourdomain.com and verify that neither X-Powered-By: PHP nor unpatched engine tags appear in the response.

Meetanshi Priority Security Engineering

Need Certified Engineers to Patch Your Servers?

The solution is to contact your server team to apply the latest PHP patch to your website. You may contact us for any help with it. Our certified security engineers provide zero-downtime updates, pool hardening, and patch verification.

Frequently Asked Questions

What are the affected PHP versions and first fixed releases?

According to the official PHP security release:
• PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12
• PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27
• PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36
• PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35
• PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.

Will patching PHP break my eCommerce store or website?

No. The patches released in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are point-release security fixes. They contain no backward-incompatible API changes and do not break themes, extensions, or core application code.

Can a Web Application Firewall (WAF) completely replace patching?

While WAF rules (such as Cloudflare Managed Rules or ModSecurity) can filter known exploit payloads, they cannot prevent memory corruption triggered through legitimate application flows or internal API endpoints. Runtime binary patching is essential for complete protection.

What is the fastest way to get help with remediation?

Click the Immediate Fix button or contact our emergency desk at help@meetanshi.com. Our certified engineers will review your server environment and coordinate immediate zero-downtime remediation.