maxanoo
Menu

PHP: two critical vulnerabilities, updates since 21 October 2026

On 21 October 2026 PHP fixed two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619). Which versions contain the fixes and what Magento shops should do now.

Published Updated 2 min read by General Magento
Red warning light: PHP security release at 14:00 UTC

The PHP project announced an unscheduled security release on 20 October 2026 and published it on 21 October at 14:00 UTC. It fixes two vulnerabilities, both rated 9.2 (CVSS 4.0): CVE-2026-109618 and CVE-2026-109619. Information about them had become public before the release.

The updates

  • PHP 8.5 → 8.5.12
  • PHP 8.4 → 8.4.27
  • PHP 8.3 → 8.3.36
  • PHP 8.2 → 8.2.35

PHP 8.1 and older no longer receive updates from the PHP project. Minimal source backports exist for 7.4, 8.0 and 8.1; whether your distribution or hosting provider builds packages from them is something you need to ask them.

What the vulnerabilities allow

Both lead to code execution via web requests. CVE-2026-109618 concerns out-of-memory handling in the middle of processing a request; CVE-2026-109619 concerns state that survives a request and is used by the next one on the same worker. According to PHP, every installation serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where a single request is enough, before any application code runs.

Sources disagree on whether the vulnerabilities are already being widely exploited. watchTowr reports attacks since 21 October, other reports are more cautious. For shop owners it makes no difference: update.

What Magento shops should do

  1. Inventory: which PHP version runs on the web server, PHP-FPM, cron and queue consumers? CLI and FPM can differ.
  2. Apply the update: via your package source (distribution, Ondřej PPA, Remi, Docker image), or ask your hosting provider when the update arrives.
  3. After updating: restart PHP-FPM or Apache and check the version in the web context, not just on the command line.
  4. In the meantime: PHP lists settings that reduce the risk but do not remove it: session.upload_progress.enabled=0, a lower post_max_size and memory_limit=-1. They have to be set in php.ini or the FPM pool, not via ini_set(). memory_limit=-1 in particular has side effects and should only be set briefly and with care.
  5. Keep watching: keep an eye on logs and new PHP files in pub/, pub/media/ and var/ over the next days.

Shops on PHP 8.1 or older should have an upgrade plan now. For Magento 2 this usually depends on the Magento version.

If you are not sure whether your servers are affected, or need someone to apply the update, write to me.

Sources: php.net: announcement and release · watchTowr: CVE-2026-109618 FAQ. First published 21 Oct 2026, updated 25 Oct 2026.