PHP's October security updates need a runtime check

What changed on October 21

The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. Its October 21 advisory covers installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project identifies mod_php as the highest risk and says there is no complete mitigation in place of updating.

The fixed releases

The announcement lists these initial fixes. Use the current supported release for your branch, or a package your distribution confirms includes both fixes.

Distributions may backport patches without adopting those upstream version numbers. Keep the vendor advisory alongside the installed package version. PHP's update guidance explains the distribution and older-version cases.

KernelHawk's recommendation: verify the serving process

For a business using managed hosting, send the provider three questions: Which PHP build serves our domain? Does it include both fixes? When was the serving process restarted or replaced?

For an internal IT team, check each web pool and container image. The command-line PHP installation can differ from the one handling web traffic. Record the package or image, the affected sites, and the person responsible for the change.

After the update, test the paths the business depends on: sign-in, checkout, booking, forms, and scheduled jobs. Save the result with the version evidence so the next person can tell what was verified. A scanner result or a host's general “fully updated” message is a starting point; the running build closes the question.

Related: how to put vulnerability fixes in order.