On 21 October 2026, the PHP project released an emergency security update. It fixes two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), meaning an attacker could run their own code on a server without logging in.
PHP powers a huge share of the web, including Magento stores, WordPress sites, Laravel applications and many custom business platforms. If your business runs on PHP, this update matters to you, even if you never touch the code yourself.
Don’t want to handle it yourself? Coreway Solution has expert developers who manage PHP security. Contact us, share your server or VPS details securely, and our developers will take care of the update for you. Details are in the section “Let Coreway’s developers handle it” below.
What was announced
The PHP security team gave advance notice on 20 October, then published the fixes the next day. The two vulnerabilities are:
- CVE-2026-109618: remote code execution caused by out-of-memory corruption. In simple terms, if PHP runs out of memory at a bad moment, it can be left holding half-prepared internal data, and cleanup code may then treat that invalid data as valid.
- CVE-2026-109619: remote code execution caused by stale global state. Internal data tied to one request can survive after the memory behind it is freed, and a later request handled by the same worker may use it.
Both are rated 9.2 on the CVSS v4.0 scale, which is in the critical range.
Who is at risk?
According to the PHP project, all PHP installations that serve web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.
The key point for business owners is that the weakness is in PHP itself, not in your application. A website built with excellent code can still be exposed if the PHP version underneath it is not patched.
Two important points from the PHP announcement:
- PHP 8.1 and older no longer receive updates from the PHP project. Some Linux distributions and long-term support vendors provide backported fixes, but you need to confirm that yours does. Otherwise, the safe path is to upgrade to a supported version.
- PHP 8.2 reaches end of life on 31 December 2026. After that date it gets no further security fixes.
The PHP team is clear that there are no complete mitigations and that updating is the only safe choice.
What this means for your business
A remote code execution flaw is one of the most serious kinds of vulnerability. If it is exploited on an unpatched server, the possible consequences include:
- Exposure of customer data, orders and payment-related information
- Website defacement, malware injection or hidden redirects that damage your search ranking and brand
- Downtime during peak sales periods
- Use of your server to attack others
- Compliance, legal and reputational problems after a breach
For an eCommerce store or a SaaS platform, even a few hours of exposure can be costly. That is why a prompt, well-managed update is better than a rushed one.
Your action plan
1. Find out which PHP version you run
Ask your developer or hosting provider, or check your server. A server can have more than one PHP version installed, and the command line version may differ from the one serving your website, so check the one used for web requests.
2. Take a full backup
Before any change, back up your files and database, and confirm you can restore them.
3. Test on a staging copy
Apply the update on a staging environment first. Browse the site, test checkout, logins, forms, file uploads and admin tasks, and review the error logs.
4. Update PHP on production and restart
Update to the fixed version for your branch, through your distribution’s packages or your hosting control panel. Then restart PHP-FPM or the web server, because a patched package does nothing until the running workers restart. Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages. The PHP project also warns that the volunteer-maintained rpms.remirepo.net repository would not have updates on release day, so users of that repository should switch to distribution packages or build from source.
5. Verify
Confirm the running version, then re-test the site.
6. Plan for older versions now
If you are on PHP 8.1 or older, or on 8.2, put an upgrade on your roadmap. Moving across several versions can break old plugins, themes and custom code, so it should be planned and tested, not rushed.
If you can’t update immediately
PHP lists configuration measures that reduce exposure to specific attack paths. They are not a substitute for the update:
- Disable session upload progress: session.upload_progress.enabled = 0 (set in php.ini or the server/pool configuration, then restart all workers).
- On PHP 8.5, set fatal_error_backtraces = 0.
- Set a low post_max_size (8M for apps without uploads, 32M for apps that need them), and keep upload_max_filesize below it.
- Apply request-size, header-count and field-count limits at the web server or proxy level.
- Fix any attacker-reachable fatal errors and timeouts in your code, especially in upload and import processing.
Treat these as a short-term stopgap while you schedule the real upgrade.
Platform-specific considerations
Magento 2: Each Magento release supports only certain PHP versions, so confirm compatibility before upgrading PHP, and test the full checkout, payment and shipping flow on staging. Older Magento stores may be stuck on PHP versions that no longer receive fixes, which is a strong reason to plan a platform upgrade.
WordPress: Update PHP, then update WordPress core, themes and plugins. Remove plugins you no longer use, as each one is extra attack surface.
Laravel and custom PHP: Run your automated tests, check dependencies with composer outdated, and review deprecated features before moving to a newer PHP version.
PHP security is more than one patch
This is not the only security release this year. PHP.net’s 2026 archive shows security releases for PHP 8.5 in May, July, September and October, with matching releases for the 8.4, 8.3 and 8.2 branches. A server configured once and never touched again will quickly fall behind. The PHP manual’s own security guidance says the best approach is to update often and stay aware of the latest versions and their changes.
Good security hygiene for PHP applications also includes:
- Prepared statements for every database query, to prevent SQL injection
- password_hash() for storing passwords
- Output escaping with htmlspecialchars() to prevent cross-site scripting (XSS)
- Secure sessions: httponly, secure and samesite cookie flags, and session_regenerate_id(true) after login
- Safe file uploads: validate type and size, and store files outside executable directories
- Errors hidden from visitors (display_errors = Off) but logged privately
- Least-privilege access for the PHP process, database users and server accounts
- Dependency updates for Composer packages, plugins and extensions
- Tested backups and monitoring, so you detect problems early and can recover fast
Let Coreway’s developers handle it
Securing a server is not something every business has the time or in-house skills for, and a mistake during an upgrade can take a site offline. Coreway Solution has expert developers who manage PHP security, and we can do the work for you.
How it works:
- Contact us. Email info@corewaysolution.com or use the contact page on our website, and tell us briefly what you run (for example Magento, WordPress, Laravel or a custom PHP application).
- Share your server details. Send us the details of your VPS or server, such as the provider, operating system, web server (Apache or NGINX), PHP version, and the applications hosted on it. Please share access credentials only through the secure method our team agrees with you (see the safety tips below), never in a plain, open message.
- A developer reviews your setup. We check your PHP version, configuration and exposure, then agree a plan with you, including backups and testing.
- We apply and verify the update. Our developers update PHP, restart services, check that your site, checkout and integrations work, and tell you what was done.
- We help you stay protected. If you want, we can continue with ongoing maintenance, monitoring and regular security updates, so you are not caught out by the next release.
What our developers can help with:
- Checking which PHP version your server really runs
- Safe PHP updates and upgrades on VPS and cloud servers
- Applying PHP’s recommended temporary configuration measures if an immediate upgrade isn’t possible
- Moving older applications off unsupported PHP versions
- Magento 2, WordPress and Laravel compatibility checks and testing
- Server hardening, monitoring and ongoing support
- Cloud and DevOps support, including secure, automated deployments
Coreway Solution already provides post-launch support and maintenance that includes security updates and server monitoring, and our team works with legacy systems while protecting performance, security and data integrity.
Safety tips when sharing server details
Giving someone access to your server is a trust decision. Whoever you work with, follow these practices:
- Take a backup first and confirm it can be restored.
- Prefer SSH keys or a temporary account over sharing your main password.
- Give only the access that is needed (a dedicated user instead of your root login where possible).
- Never send passwords in a plain email or chat. Use a secure sharing method that the developer agrees with you.
- Remove or rotate access when the work is finished, and change any shared password afterwards.
- Ask for a short summary of what was changed so you have a record.
- Work under an NDA if you need one. Coreway signs NDAs with clients and follows data privacy standards.
Quick checklist
- Identify your PHP version (the one serving web requests)
- Take a backup and confirm you can restore it
- Test the update on staging
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a newer supported release)
- Restart PHP-FPM or the web server
- Re-test checkout, logins, forms and uploads
- Plan to leave PHP 8.1 and older, and 8.2 before 31 December 2026
- Or contact Coreway and let our developers do it for you
Final thoughts
Critical PHP vulnerabilities are a reminder that security is a process, not a one-time task. The businesses that handle these events best are the ones with regular updates, tested backups and a team that responds quickly.
Not sure whether your server is safe? Contact Coreway Solution at info@corewaysolution.com or through our contact page. Share your VPS or server details, and our expert developers will secure your PHP environment so you can focus on your business.
Source: PHP.net News Archive 2026 (https://www.php.net/archive/2026.php) and the PHP Manual, Security → Keeping Current.