Critical PHP Security Release, October 21, 2026: What We Know and What to Do

On October 20, 2026, the PHP security team published advance notice of an emergency security release. It fixes two critical vulnerabilities, each rated 9.2 out of 10 on the CVSS v4.0 scale. Below we explain what is known, who is affected, and what you need to do.

In short

The release is scheduled for October 21, 2026 at 14:00 UTC (17:00 Kyiv time).
Shared hosting customers don’t need to do anything: we are updating our servers ourselves.
VPS and dedicated server owners need to update PHP themselves as soon as updated packages are available for their distribution.

What the PHP team announced

According to the official announcement on php.net:

the security release is scheduled for Wednesday, October 21, 2026 at 14:00 UTC;
it fixes two critical vulnerabilities, both rated CVSS v4.0 9.2;
all PHP users are encouraged to prepare now so they can upgrade as soon as the release is out;
the team may release earlier if details of the vulnerabilities become public or if there is evidence of active exploitation;
full details, affected versions and fixed versions will be published together with the release.

What researchers are reporting

Information about the vulnerabilities became public ahead of the planned disclosure. According to security researchers (including watchTowr), these are remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. They report that PHP versions 5, 7 and 8 are affected.

Note: these identifiers and the list of affected versions have not yet been confirmed in the official PHP announcement. We will update this post once the PHP team publishes the details.

An RCE vulnerability means that a successful attacker can run arbitrary code on the server: access website files and databases, install malware, and so on. That’s why the update should be applied as soon as possible.

Who is affected

The vulnerabilities are in PHP itself, not in a specific CMS or control panel. Any server running PHP is potentially affected, whether it runs WordPress, OpenCart, Joomla, Laravel or custom code, with or without a control panel.

Shared hosting: what we are doing

On our shared hosting servers we will install the update for all available PHP versions as soon as updated packages are released. No action is required from you. PHP may be restarted briefly during the update.

If your site runs on PHP 8.1 or older, we recommend switching to a newer version in your control panel. These versions are no longer supported by the PHP developers and will not receive official fixes. If anything breaks after switching, please open a support ticket.

VPS and dedicated servers: what to do

On a VPS, the software is managed by the customer, so you need to update PHP yourself. After the release, fixed packages will appear in your distribution’s repositories, usually within a few hours to a day.

1. Check which PHP version is installed

php -v
systemctl list-units --type=service 'php*'

The second command lists all running PHP-FPM services: a server may run several PHP versions at once.

2. Update PHP

Debian / Ubuntu:

sudo apt update
sudo apt upgrade

AlmaLinux / Rocky Linux / RHEL:

sudo dnf upgrade 'php*'

If PHP was installed from third-party repositories (such as ondrej/php or Remi), the fix will come from there, again via apt or dnf. If your server has a control panel, update PHP through it.

3. Restart PHP-FPM or the web server

sudo systemctl restart php8.3-fpm   # replace with your version
# or, if PHP runs as an Apache module:
sudo systemctl restart apache2      # or httpd

4. Verify

Run php -v again and make sure the version matches a fixed release. The list of fixed versions will be published on php.net together with the release.

If you run an old PHP version

The PHP developers currently support branches 8.2, 8.3, 8.4 and 8.5. PHP 8.1 and older will not receive official fixes. You have two options:

upgrade to a supported PHP version (recommended);
use a PHP build where your distribution or control panel vendor has backported the fix, if you have such a vendor.

Need help?

If you’re not sure how to update PHP on your VPS, or would rather not do it yourself, we can do it for you as a paid service. Open a support ticket and we’ll help.

Sources

This post will be updated once the PHP team publishes the release and details.