Critical PHP Security Updates Expected October 21
The PHP Security Team has announced an upcoming security release addressing two critical vulnerabilities affecting PHP, a widely used programming language that powers websites and web applications.
Both vulnerabilities have received a CVSS severity score of 9.2 out of 10. Early reporting from security researchers suggests the vulnerabilities may allow remote code execution (RCE), potentially enabling attackers to run unauthorized code on affected systems.
The security updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC (10:00 AM Eastern).
Full technical details and confirmed affected versions are expected with the official release.
Who may be affected?
Organizations running PHP-based websites, applications, or servers should review their environments for potential exposure.
PHP is commonly used in content management systems such as WordPress, custom business applications, and other web services.
The reported vulnerability scope includes PHP 5 and newer, meaning even older applications and websites should be evaluated for potential exposure. However, the PHP Security Team has not yet officially confirmed the affected versions.
Joe Ferguson, a contributor to the PHP project, emphasized the scope of the issue in a recent discussion, stating: “Are you running PHP? You're impacted.”
In practical terms, organizations should assume that any website or application running PHP may be vulnerable until confirmed otherwise.
Source: PHP Security Release Discussion
Official security patches are expected to be limited to PHP 8.2 and newer, according to PHP contributor Morrison Levi. Organizations operating earlier versions should not expect official upstream fixes for these vulnerabilities.
Some Linux distributions and third-party vendors may provide security updates for older PHP releases. Administrators should check with their software vendors or hosting providers to determine whether a supported fix will be available.
We strongly recommend always running a supported version of PHP. Unsupported versions no longer receive official security updates, leaving organizations exposed to newly discovered vulnerabilities without a reliable path to remediation.
Systems running unsupported versions should be prioritized for upgrades to a currently supported release. Where an immediate upgrade or security fix is not possible, administrators should consider temporarily restricting public access until the system can be properly secured.
Source: PHP Patch Availability Discussion
Recommended Next Steps
While additional information is pending, organizations and IT administrators should begin preparing:
Identify PHP installations. Review websites, applications, and servers to determine where PHP is being used, including older applications.
Check installed versions. Document PHP versions, paying particular attention to systems running PHP 5 through PHP 7, which no longer receive upstream security updates.
Prepare for the October 21 release. Security patches are scheduled for 14:00 UTC (10:00 AM Eastern). Review the official advisories and prioritize updates to affected systems once available.
Plan upgrades for unsupported versions. Older PHP installations may require application compatibility testing, code changes, or migration to supported PHP 8 versions.
Verify backups and compatibility. Ensure current backups are available and confirm application compatibility before deploying updates.
What Happens Next?
The PHP Security Team is expected to publish updated releases and additional vulnerability details on October 21.
As reported by RuntimeWire, early security research has raised concerns about potential remote code execution vulnerabilities. However, the specific exploitation conditions and full impact remain unconfirmed pending the official disclosure.
Administrators should review the release details as they become available and prioritize patching internet-facing systems where applicable.
If you're unsure whether your website or applications may be affected, or need assistance reviewing your PHP environment and applying the necessary updates, reach out to the Anteris team. We're happy to help assess your exposure and determine the appropriate next steps.
Update: October 21, 2026 – Additional Findings & Mitigations
Additional information has emerged regarding the two critical PHP vulnerabilities announced yesterday.
Early security research suggests that nearly all PHP versions from PHP 5 onward may be affected, potentially exposing a wide range of websites and applications. Official upstream security patches are expected to be limited to PHP 8.2 and newer.
The PHP Security Team has not yet officially confirmed the affected versions or released the full technical details.
We have already begun observing what appear to be exploitation attempts against websites, including smaller, lower-profile sites. This is an important reminder that attackers do not exclusively target large organizations. Automated attacks can affect websites of any size, regardless of their visibility or industry.
While we await the official security patches, administrators may be able to reduce exposure through the following temporary measures:
1. Disable PHP Session Upload Progress
Researchers have identified PHP's session upload progress functionality as a potential exploitation path. Administrators should consider disabling this feature to eliminate one exploitation path:
session.upload_progress.enabled = Off
With this setting off:
PHP does not track file upload progress in the $_SESSION variable.
Applications cannot use PHP's built-in session-based tracking to display upload percentages.
File uploads still work normally. This setting does not prevent users from uploading files.
2. Restrict Multipart and POST Requests
Administrators should consider temporarily blocking multipart/form-data requests before they are processed by PHP, using NGINX, another web server, or a web application firewall (WAF).
For applications that do not require POST requests, temporarily blocking those requests entirely may provide additional protection.
Important: These restrictions may temporarily interfere with legitimate website functionality, including form submissions, authentication, and file uploads. However, given the severity of these vulnerabilities and the potential consequences of exploitation, a temporary disruption is worth the additional protection.
If patching or implementing these mitigations is not immediately possible, we strongly recommend temporarily disconnecting affected systems from the public internet until they can be properly secured. This is particularly important for internet-facing systems, where continued exposure may present a significant security risk.
These measures are precautionary and have not yet been confirmed to fully mitigate either vulnerability. They should not be considered replacements for installing the official security patches.
Security updates remain scheduled for release today, October 21, at 14:00 UTC (10:00 AM Eastern).
We recommend that administrators review the official advisories once published and prioritize patching affected systems immediately.
For assistance reviewing your environment or implementing appropriate mitigations, please contact Anteris.
Update: October 21, 2026 – Critical PHP Security Patches Now Available
The PHP Security Team has officially released security patches addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both of which can allow unauthenticated remote code execution (RCE).
The advisory confirms that all PHP installations serving web requests should be considered at risk, including environments using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Of particular concern, researchers have demonstrated an exploit against Apache mod_php that can be triggered by an unauthenticated request before application code is executed.
Immediate patching is strongly recommended.
Confirmed Security Updates
The following PHP versions address both vulnerabilities:
PHP 8.5: Update to 8.5.12
PHP 8.4: Update to 8.4.27
PHP 8.3: Update to 8.3.36
PHP 8.2: Update to 8.2.35
PHP 8.1 and earlier are no longer officially supported. Some Linux distributions and long-term support vendors have received patches for older versions and may provide updated packages.
The PHP Security Team has also made limited source-level fixes available for PHP 7.4, 8.0, and 8.1. However, these do not replace the need to migrate to a supported PHP release.
What If You Cannot Patch Immediately?
The PHP Security Team has confirmed that there are no complete workarounds for these vulnerabilities. Updating is the only comprehensive solution.
However, several temporary measures may reduce exposure to specific exploitation paths:
1. Disable Session Upload Progress
Disable PHP's session upload progress functionality and restart all PHP workers:
session.upload_progress.enabled = 0
This addresses confirmed exploitation paths related to session upload progress, but does not prevent every possible exploitation method.
2. Review PHP Memory Limits
For CVE-2026-109618, PHP recommends considering:
memory_limit = -1
This removes a controllable PHP memory-limit failure condition involved in the vulnerability. However, administrators must carefully consider system resource usage and apply appropriate container or cgroup resource limits.
This is a temporary mitigation, not a complete fix.
3. Restrict Unnecessary Requests
Administrators should continue evaluating restrictions on unnecessary multipart requests and applying appropriate web server or WAF request limits.
PHP also recommends limiting POST body sizes, multipart complexity, and other resource-intensive request characteristics.
These measures can reduce exposure but may affect legitimate website functionality.
4. Restrict Public Access When Necessary
If an affected system cannot be patched or adequately protected, we strongly recommend temporarily restricting or disconnecting it from the public internet until remediation is possible.
Recommended Next Steps
Organizations should take immediate action:
Update affected PHP installations to the appropriate patched versions.
Contact hosting providers or software vendors if PHP is managed through third-party packages.
Prioritize publicly accessible websites and applications, particularly those using Apache mod_php.
Verify successful patch installation and restart PHP workers or services as required.
Review unsupported PHP environments and establish a plan to migrate to a supported release.
Temporary mitigations should not be treated as substitutes for patching.
How Anteris Is Responding
Our team has been actively monitoring these vulnerabilities and implementing appropriate precautions across the client environments we manage.
With the official patches now available, our priority is deploying the applicable updates, confirming successful remediation, and addressing any environments that require additional upgrades or compatibility work.
If your website is hosted by Anteris, our team is coordinating the necessary security updates.
If you're unsure whether your website or applications may be affected, or need assistance applying the updates, please contact Anteris.