Security advisory · PHP
Critical PHP flaws. Patch your servers now.
Two new vulnerabilities let an unauthenticated request run code on PHP servers. We update your servers and applications to a patched PHP version, and keep your site running while we do.
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Every PHP server that serves web requests is at risk.
The PHP project rates the risk highest for Apache with mod_php, where a demonstrated exploit runs before any application code.
- PHP-FPM
- Apache mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
Two remote code execution flaws
CVE-2026-109618
RCE via out-of-memory corruption
Running out of memory can interrupt PHP while request data is half set up. Cleanup then treats the broken data as valid.
CVE-2026-109619
RCE via stale global state
Request state can outlive its memory. The next request on the same worker may use it before PHP resets it.
PHP 8.1 and older get no updates from the PHP project. Only minimal source backports exist, so the safe fix is an upgrade to a supported version.
How we get you patched
01
Audit
We check PHP versions, SAPI, ini settings and hosting on every server, and list what is exposed.
02
Harden today
If you cannot update right away, we apply the advised interim settings to cut exposure while we plan the upgrade.
03
Upgrade
We move you to a patched PHP version and fix the application code that breaks: WordPress, WooCommerce, Laravel or custom.
04
Verify & maintain
We test the site, watch the logs after go-live, and can keep PHP patched on a support plan.
Want PHP kept up to date after this? See our support plans.
Cannot update today?
These settings reduce exposure to the known attack paths. They do not make a server safe; only the update does.
- Disable session.upload_progress in php.ini or the FPM pool, then restart every worker.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
- Lower post_max_size (8M without uploads, 32M with) and cap request size at the web server or proxy.
- Run PHP workers under a container or cgroup memory limit that kills only the affected worker.
Questions
Does my hosting provider fix this for me?
Managed hosts usually patch PHP itself, but often leave the version choice to you. If your site runs on PHP 8.1 or older, or on your own VPS or server, you need to act.
Will upgrading PHP break my site?
A patch release within the same version (for example 8.3.x to 8.3.36) rarely does. Moving from end-of-life PHP to 8.2 or newer can break old plugins and code; we find and fix that on a copy first.
How fast can you start?
Send the form or message us on WhatsApp. We reply within 1 business day with a plan and a start date.
Is setting memory_limit or hiding errors enough?
No. Interim settings only block specific attack paths, and hiding diagnostics with display_errors or @ does not help at all. The update is the only complete fix.
Get your servers patched
Tell us which servers and sites run PHP and what version they use, if you know. We reply with a plan and an estimate.