PHP Security Update: CVE-2026-109618 and CVE-2026-109619
Updated on October 26, 2026
On October 21, 2026, the PHP project released security updates for every supported version of PHP. The updates fix two vulnerabilities that allow unauthenticated remote code execution, both rated 9.2 (Critical) on the CVSS scale.
This doc explains what was fixed, what SpinupWP is doing about it, and how to confirm your servers are patched.
What Was Fixed
| CVE | Summary |
|---|---|
| CVE-2026-109618 | Out-of-memory handling can interrupt PHP while request data is only partially set up. Request cleanup may then treat that invalid data as valid. |
| CVE-2026-109619 | Request-owned internal state can outlive the memory it belongs to. A later request on the same worker may reuse that stale state before it is reset. |
These vulnerabilities affect PHP installations serving web requests, including PHP-FPM, which is what SpinupWP servers use. The conditions for exploitation vary, so sites should be updated regardless of their plugins or themes.
The full details are in the PHP security advisory.
What SpinupWP Is Doing
Because of the severity of these vulnerabilities, SpinupWP is automatically updating every installed PHP version on all provisioned servers running Ubuntu 22.04 or newer. This is one of the rare cases where we make a change to your server without you initiating it.
The update installs the latest packages for each version of PHP present on the server, tests the PHP-FPM configuration, and restarts PHP-FPM. Restarting PHP-FPM may cause a brief interruption to requests on your sites while the new version starts up.
If the automatic update fails on a server, SpinupWP adds an upgrade named Update PHP versions to that server’s dashboard. Review the failed task output and then run the upgrade again, the same way you would run any other required upgrade.
Patched Versions
SpinupWP servers install PHP from the packages.sury.org repository maintained by Ondřej Surý. Patched packages were published there on October 21, 2026 for PHP 7.1 through 8.5 on amd64, with arm64 builds following over the next few days. To patch ARM servers sooner, SpinupWP temporarily used the same maintainer’s ppa:ondrej/php Launchpad PPA on ARM servers running Ubuntu 22.04 and 24.04. Both repositories publish the same packages.
For PHP 8.2 and newer, the PHP version number itself changes. For PHP 8.1 and older, the fix is a backport, so the PHP version number stays the same before and after the update and only the package revision changes. In both cases, the package version is what you should compare, using the check below.
| PHP | Patched PHP Version | Minimum Patched Package Version | Vulnerable If Package Version Is |
|---|---|---|---|
| 8.5 | 8.5.12 | 8.5.12-1 |
8.5.11 or lower |
| 8.4 | 8.4.27 | 8.4.27-1 |
8.4.26 or lower |
| 8.3 | 8.3.36 | 8.3.36-1 |
8.3.35 or lower |
| 8.2 | 8.2.35 | 8.2.35-1 |
8.2.34 or lower |
| 8.1 | 8.1.34 (unchanged) | 8.1.34-9 |
8.1.34-8 or lower |
| 8.0 | 8.0.30 (unchanged) | 1:8.0.30-25 |
8.0.30-24 or lower |
| 7.4 | 7.4.33 (unchanged) | 1:7.4.33-31 |
7.4.33-30 or lower |
| 7.3 | 7.3.33 (unchanged) | 7.3.33-35 |
7.3.33-34 or lower |
| 7.2 | 7.2.34 (unchanged) | 7.2.34-66 |
7.2.34-65 or lower |
| 7.1 | 7.1.33 (unchanged) | 7.1.33-80 |
7.1.33-79 or lower |
The package version on your server will have a longer suffix after the revision. It looks different depending on which repository the server uses, but the part before the first + is the same in both, and that’s the part to compare against the table:
8.3.36-1+0~20261021.88+ubuntu24.04~1.gbp250f7c (packages.sury.org) 8.3.36-1+ubuntu24.04.1+deb.sury.org+1 (ppa:ondrej/php)
Both of these are PHP 8.3 at revision 8.3.36-1, which is patched. A higher revision, such as 8.3.36-2, is also patched. The package maintainer occasionally rebuilds packages without changing the PHP version, so don’t rely only on the date in the suffix.
Checking a Server
Connect to your server via SSH and run:
dpkg-query -W -f='${db:Status-Abbrev}\t${binary:Package}\t${Version}\n' 'php[0-9]*-fpm' 2>/dev/null | awk '$1 == "ii" {print $2 "\t" $3}'
You’ll see one line for each version of PHP currently installed on the server. Versions that were previously removed from the server are left out.
php8.3-fpm 8.3.36-1+0~20261021.88+ubuntu24.04~1.gbp250f7c php7.4-fpm 1:7.4.33-31+0~20261021.121+ubuntu24.04~1.gbpe9c428
For each line, take the part of the version before the first + and compare it with the patched versions table. In this example, 8.3.36-1 and 1:7.4.33-31 both match the minimum patched version, so both are patched. If a line shows a lower PHP version or a lower revision than the table, that version of PHP has not been updated yet.
You can also confirm that PHP-FPM was restarted after the update:
systemctl status php8.3-fpm
Replace 8.3 with the version you’re checking. The Active line should show a start time after the update ran.
ARM Servers
The package maintainer published the amd64 packages first, and the arm64 builds for packages.sury.org followed over the next few days. When the automatic update ran on October 21, there was nothing new for an ARM (arm64) server to install, so the task completed without patching anything.
The update has now been run again on all ARM servers, and they are patched. How that happened depends on the Ubuntu version:
- Ubuntu 22.04 and 24.04: the maintainer’s Launchpad PPA builds every architecture itself and had the patched arm64 packages first, so SpinupWP temporarily switched these servers to the PPA and ran the update from there. Once the arm64 packages are fully available on packages.sury.org, these servers will be switched back. The package version will have the PPA suffix shown in the Patched Versions section while the PPA is in use.
- Ubuntu 26.04: the PPA does not publish packages for Ubuntu 26.04, so these servers waited for the packages.sury.org arm64 builds. Those were published on October 25 and the update was run again from packages.sury.org.
Use the check above to confirm a server’s PHP versions. If an ARM server still shows an older version, re-run the Update PHP versions upgrade from the server’s dashboard or contact support.
While ARM servers were waiting for packages, the PHP security advisory described some partial mitigations. The main one, disabling session upload progress, has been applied to every server by SpinupWP (see the October 23 note at the top of this doc) and should stay in place. If you applied any of the other mitigations yourself, such as lowering post_max_size, you can revert them now that the patched packages are installed.
If your sites are behind Cloudflare, Cloudflare has deployed WAF rules that block known exploitation attempts for these vulnerabilities. The rules are enabled automatically on all plans, including Free. Customers on paid plans should confirm the Cloudflare Managed Ruleset is deployed in block mode. This is an extra layer of defense, not a replacement for patching PHP.
Ubuntu 20.04 Servers
SpinupWP does not automatically run this update on Ubuntu 20.04 servers. Standard support for Ubuntu 20.04 ended in May 2025 and the PHP package repository no longer publishes updates for it, so there is no patched package to install. Ubuntu Pro’s extended maintenance doesn’t help here either, for the reasons covered in our Ubuntu LTS upgrade doc.
If you still have sites on an Ubuntu 20.04 server, we recommend provisioning a new server on a current Ubuntu LTS release and using Move Site to migrate your sites to it.
Updating Manually
If you’d rather run the update yourself, connect to your server as a sudo user and run:
sudo apt update
sudo apt install --only-upgrade 'php*'
This upgrades every installed package whose name starts with php and leaves everything else alone.
Then test the configuration and restart PHP-FPM for each installed version:
sudo php-fpm8.3 -t && sudo systemctl restart php8.3-fpm
Replace 8.3 with each version of PHP installed on the server, then re-run the check above to confirm every version matches or exceeds the minimum patched version in the table.
If you run into any problems or have questions about this update, please contact support.