The PHP security team announced an emergency release for 21 October 2026 at 14:00 UTC. Reason: two critical vulnerabilities, both rated CVSS v4.0 9.2. CERT-EU identifiers: CVE-2026-109618 and CVE-2026-109619. Public reports describe them as RCE. Before the release the PHP team had not published full technical details.

Sources: PHP advance notice, CERT-EU Security Advisory 2026-018. This post is an operator checklist: version inventory, update window, plan for unsupported branches.

What is known today

On 20 October details leaked before the embargo. PHP accelerated communication and reserved an earlier release if exploitation appeared. Cloudflare reported early probes. At the time of writing, official patched tarballs may not yet be on php.net.

Expected fixed versions on supported branches (pre-release reports, including Kevin Beaumont):

  • PHP 8.5.x → 8.5.12
  • PHP 8.4.x → 8.4.27
  • PHP 8.3.x → 8.3.36
  • PHP 8.2.x → 8.2.35

EOL branches (PHP 5 through 8.1) are not expected to get an official upstream fix. Migrate to supported 8.x or use a distribution / ELS backport.

Updating WordPress, Magento, PrestaShop or plugins does not replace updating the PHP interpreter.

Who is affected

Every host with php-fpm, mod_php or PHP in a container: Magento stores, WordPress, Drupal, Laravel, Symfony, panels and appliances that ship PHP. Inventory Docker images and staging too, not only production.

CERT-EU recommends identifying PHP applications and preparing for immediate deployment. If the patch cannot land at once: consider limiting internet access to PHP applications until the fix is on the host.

What to do now

1. Version inventory. On every host and in every container:

php -v
command -v php-fpm && php-fpm -v
ls /etc/php/*/fpm 2>/dev/null
docker ps --format '{{.Names}} {{.Image}}' | grep -i php

Record the result next to the application name and whether the endpoint is public.

2. Backup and window. Before swapping packages: application and database copy, a short cart or login smoke test on staging with the same PHP branch. On production agree a window with the store owner.

3. After the fix is published. Install 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (or the distribution package with a backport). Confirm:

php -v
# you want the patched number, not only the 8.x branch
systemctl restart php*-fpm
# or restart the container / PHP pool in the hosting panel

Check the distribution status page (Debian, Ubuntu, RHEL, CloudLinux, hosting panel). Vendor packages often land an hour or two after PHP tarballs.

4. Unsupported branch. If php -v shows 7.x or 8.0/8.1 without ELS: a migration plan to 8.2+ comes before “waiting for a patch”. Upstream on those branches is not expected to fix these CVEs.

5. Edge layer. WAF rules (for example Cloudflare) limit known HTTP vectors. They do not replace a PHP update. After the patch, keep watching FPM and reverse-proxy logs for unusual POST traffic.

Layers: security. PHP stores: ecommerce. Host on-call: IT administration.

How to monitor it

Three layers, in parallel.

Version compliance. The script compares php -v to the fixed releases. Exit 1 means below the floor or an EOL branch. Fits cron and an alert.

curl -fsSL https://opselis.pl/scripts/php-cve-2026-check.sh -o php-cve-2026-check.sh
chmod +x php-cve-2026-check.sh
./php-cve-2026-check.sh
./php-cve-2026-check.sh --php /usr/bin/php8.3
./php-cve-2026-check.sh --json

Hourly cron example (syslog on failure):

0 * * * * /opt/scripts/php-cve-2026-check.sh || logger -t php-cve-check "PHP below fixed version on $(hostname)"

Wazuh. After the patch: agent on the store host, FIM on the document root (new .php under media and cache), rules for PHP/FPM spawning a shell, curl/wget or a reverse shell. SCA or package inventory shows whether php/php-fpm is below the floor. The alert has an owner and a threshold.

OpenVAS. Once the CVE is in the feed, a scan of origin and the PHP host flags an unpatched package. That is a weekly rhythm. It does not replace a php -v cron on release day.

A WAF (for example Cloudflare) limits known HTTP vectors. It does not replace a PHP update or a host alert.

In short: CVE-2026-109618 and CVE-2026-109619 are critical gaps in the PHP interpreter, release 21 October 2026 14:00 UTC. Inventory versions, install patched 8.2–8.5 as soon as packages exist. Migrate EOL branches. Do not wait for upstream there.