PHP's October 2026 Critical RCE Fix: What to Do Today

On October 21, 2026 the PHP project shipped emergency security releases fixing two critical vulnerabilities that can allow unauthenticated remote code execution. Details leaked before the coordinated release, and security vendors are reporting active exploitation. If you run anything on PHP (WordPress, Drupal, Joomla, Magento, Laravel or a custom application), this one is worth an hour of your day.

What was fixed

• CVE-2026-109618, RCE via out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and request cleanup can then treat that invalid data as valid.
• CVE-2026-109619, RCE via stale global state. Request-owned internal state can outlive the memory behind it, and a later request on the same worker can use it before it is reset.

The flaws are in PHP itself, not in a plugin or framework. Keeping WordPress or your CMS updated does not fix them.

Who is exposed

Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates the risk highest for mod_php, where a demonstrated exploit fires from an unauthenticated request before any application code runs.

How to check, in five minutes

1. Find the version actually serving your site, not just the command-line one. On a server, php -v shows the CLI; the web version is what phpinfo() reports or what your FPM service runs (php-fpm -v, or the versioned service name such as php8.3-fpm). They are often different.
2. Shared or managed hosting? Your host patches PHP for you. Check their status page or ask support for the PHP build date on your account, and confirm it is after October 21.
3. Your own VPS or server? Install your distribution's updated packages (Linux distributions received the patches in advance), then restart PHP-FPM or Apache. Old workers keep running vulnerable code until they restart.
4. Windows server (IIS, WAMP, XAMPP)? Nothing updates PHP for you here. Download the patched Windows build from php.net (match thread safety and architecture to what you run now), swap it in while keeping your php.ini and extensions, then recycle the IIS application pool or restart the Apache service.
5. Confirm the web-facing version matches the fixed list above.

If you can't update today

The PHP project is clear that only updating is a complete fix. These settings reduce specific attack paths while you schedule the update. Apply them where they take effect before request parsing (php.ini, the FPM pool or server config), not with ini_set() or .user.ini, then restart every worker.

; PHP-FPM pool example (interim mitigation only)
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 8M
php_admin_value[session.upload_progress.enabled] = 0

• On Windows, set the same values in the php.ini that IIS or Apache loads (not a per-directory override), then recycle the application pool or restart Apache.
• post_max_size: 8M if the site takes no uploads, 32M if it does, with upload_max_filesize below it.
• On PHP 8.5 also set fatal_error_backtraces=0.
• At the web server or proxy, enforce limits on request size, field and part counts, header count and nesting depth.
• Use a container or cgroup memory limit as the safety net. The advisory specifically warns not to use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable path.

If you suspect you were already hit

Exploitation started before the patch. Updating closes the hole but does not remove anything an attacker left behind. Signs worth checking: PHP files you didn't put there (especially in upload directories), new admin users, unexpected cron jobs or Windows scheduled tasks, and outbound connections from the web server. If you find any of these, treat it as an incident: preserve logs, rotate credentials and database passwords, and rebuild from a known-good source rather than cleaning in place.

Fixed-price help from Kapstone

For organizations running their own Linux or Windows servers who want it done and documented:

Scope note: these packages cover patching and upgrade planning. If we find signs of compromise we stop, tell you what we found, and quote incident response separately.

Sources

• PHP security advisory and release announcements (php.net)
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Patchstack: active exploitation reports