On October 21, the PHP project released fixes for two critical vulnerabilities that could lead to remote code execution. The advisories identify them as CVE-2026-109618 and CVE-2026-109619. Operators should check every affected PHP runtime and update without waiting for their usual maintenance window.
What PHP released
Maintained branches have fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Technical details are in the project announcement and the CERT-EU advisory. Apply the release that matches the branch actually used by your applications.
The “critical” rating does not mean every server has the same exposure. Risk depends on versions, configuration and deployment. The advisory is still enough reason to prioritize inventory and patching.
Map runtimes before updating
List websites, scheduled jobs, containers, functions and test environments that run PHP. CLI and web-server versions can differ. Rebuild and redeploy immutable container images rather than only patching a host.
If your branch is end of life, check notices from your distribution or provider. Do not switch branches without validating application compatibility; prefer a security fix maintained by your vendor.
Deploy and confirm the fix
Test updates in a representative environment, then deploy through your team’s change process. Restart persistent processes and workers so they load the fixed libraries. Updating a package without restarting does not guarantee that in-memory code changed.
After deployment, check the version from the runtime that actually serves requests, then watch application errors and logs. Record the version, deployed image and restart time.
What the advisories do not say
The release of fixes does not by itself prove a server was compromised. The selected sources do not confirm widespread exploitation. Teams that find unusual activity should investigate and preserve logs; they should not attribute an incident to these CVEs without evidence.
Organize technical access
During maintenance, teams can keep required business credentials in an encrypted vault and share them under access rules. Soclyde helps organize team secrets; it does not patch PHP vulnerabilities or replace updates and monitoring.
Explore Soclyde features for managing team secrets.
What to remember
Install fixed PHP releases for your branches, restart affected processes and verify the version serving applications. The advisory signals serious risk, not proof of compromise. Our guide to securing work passwords complements this work on access management.
