Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow remote code execution on unpatched servers. Learn which versions to upgrade to, why Cloudflare protection isn’t enough, and what to do if you can’t update right away.
Server administrators and website owners running PHP are being urged to apply the latest security updates following reports of two critical vulnerabilities that could expose web servers to remote code execution (RCE) attacks.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are reportedly rated CVSS v4.0 9.2, placing them in the critical severity category. If exploited, such vulnerabilities could allow attackers to execute malicious code remotely without authentication, potentially putting affected websites, applications, and server infrastructure at risk.
Which PHP Versions Are Affected?
Administrators using the affected PHP release series are advised to upgrade to the following patched versions, as specified in the supplied security notice:
- PHP 8.5: Update to 8.5.12
- PHP 8.4: Update to 8.4.27
- PHP 8.3: Update to 8.3.36
- PHP 8.2: Update to 8.2.35
Administrators should confirm the correct patched package for their operating system and PHP distribution before proceeding. Version numbers supplied by Linux distributions and long-term support (LTS) vendors may differ from the upstream PHP release numbers.
Why This Security Update Matters
Remote code execution vulnerabilities are particularly serious because they may allow attackers to run commands or malicious code on a vulnerable server remotely.
Depending on the server configuration and the privileges available to the affected PHP process, a successful attack could compromise website files, expose sensitive information, disrupt services, or provide a foothold for further attacks.
Because PHP powers a large number of websites, content management systems, web applications, and hosting environments, administrators should assess their exposure and prioritize remediation.
What Should Server Administrators Do?
To reduce the risk of exploitation, administrators should take the following steps:
1. Identify installed PHP versions: Check every PHP version used by websites and applications on the server, including separately configured PHP-FPM services.
2. Install the appropriate security updates: Upgrade to a patched release or install the corresponding security package provided by your operating system vendor.
3. Restart affected services if required: Follow the package maintainer's instructions to ensure the updated PHP binaries and services are running.
4. Verify the update: Confirm that websites and applications are using the patched version and that the update has been applied successfully.
5. Review server security: Check application logs and server activity for suspicious behavior, and investigate any signs of unauthorized access.
For hosting providers and administrators managing multiple websites, it is important to check all PHP versions available on the server rather than updating only the default version.
Does Cloudflare Protection Fix the Vulnerability?
Cloudflare has reportedly deployed Web Application Firewall (WAF) mitigations for websites protected by its services. These measures may help block certain exploitation attempts, but they do not remove the underlying vulnerability from the PHP installation.
Cloudflare protection should therefore be treated as an additional defensive layer, not a replacement for installing the relevant security patches.
What If You Cannot Update Immediately?
If an immediate upgrade is not possible, administrators should consult the official PHP security advisory for any documented temporary mitigations applicable to their configuration.
Where feasible, restrict unnecessary public access to vulnerable services, review existing security controls, and plan the update as a priority. Temporary mitigations should not be considered a permanent solution.
Final Recommendations
This reported security issue highlights the importance of keeping server software up to date. Website owners, developers, system administrators, and hosting providers should verify their PHP versions and apply the appropriate security updates as soon as possible.
For the latest technical details, affected release information, and official remediation guidance, consult the official PHP website
Security reminder: Keeping PHP and other server components updated is an essential part of protecting websites, customer data, and hosting infrastructure against emerging threats.
Editorial note: Verify the CVE identifiers, severity scores, and patched versions against official PHP security announcements before publishing.
