Critical PHP Vulnerabilities in October 2026: What We Did and What You Should Check

What Happened and Why It Matters

On October 21, 2026, the PHP project released versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, patching two critical vulnerabilities in the PHP interpreter itself: CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4 score of 9.2, and the official advisories are published on the php-src GitHub repository (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp). One key point worth emphasizing: the flaw is not in WordPress, WooCommerce, Laravel, or any plugin. It is in PHP itself. That means every site running on an unpatched PHP version is exposed, regardless of how up to date the application layer is. Technical details surfaced publicly before the official release, and reports of active exploitation remain contradictory at this point, but the risk level is considered high and should not be dismissed.

What Each Vulnerability Actually Does

• CVE-2026-109618 targets multipart HTTP POST requests, the exact type used for file uploads. A specially crafted request can push PHP into memory exhaustion, with the potential for remote code execution (RCE). Any upload form, product image field, or file attachment feature on an unpatched server is a possible entry point.
• CVE-2026-109619 exploits a memory state left behind after a fatal error or out-of-memory condition. The primary attack vector is the session upload progress feature, which is enabled by default in PHP. The potential outcome is also RCE. Session upload progress is involved only in CVE-2026-109619, not in both vulnerabilities.
• PHP 8.1 and older versions (8.0, 7.x, 5.x) no longer receive security patches from the PHP project. If your site runs on one of these versions, there is no official fix available and the exposure remains open indefinitely.

What MioriticHost Has Already Done

On the same day the advisories were published, we applied an immediate mitigation across all hosting servers for every active PHP version: we disabled session.upload_progress and, on PHP 8.5, also disabled fatal_error_backtraces, following the recommendations in the official advisories. The only visible effect for end users is that upload progress bars relying on this feature will no longer display a live percentage. File uploads themselves continue to work normally. This mitigation closes the session upload progress attack path, covering CVE-2026-109619. It does not cover CVE-2026-109618 and is not a substitute for the full patch. For that reason, we are installing the corrected PHP packages as soon as they become available through cPanel and CloudLinux, without waiting for the scheduled overnight update window. You do not need to do anything for these two measures. We are not claiming you are 100% protected, but the available attack surface has been meaningfully reduced while the full patch is applied.

The mitigation disables session.upload_progress per the official advisory recommendation and reduces risk for CVE-2026-109619. The full patch, which also covers CVE-2026-109618, is being installed as soon as it becomes available through cPanel and CloudLinux.

What You Can Do Right Now

The following steps are concrete and can be done today directly from cPanel:

• Check which PHP version your site is running. Log in to cPanel, open MultiPHP Manager or Select PHP Version, and note the version in use. If it is 8.1 or older, you are on a branch that no longer receives security patches from the PHP project.
• Move to PHP 8.3 or 8.4. Before making any change, take a full backup through JetBackup. Update WordPress, your theme, and all plugins (or your application framework) to their latest versions first, to minimize compatibility issues. Then switch the PHP version from the same cPanel menu, save, and test your site thoroughly: pages, forms, and the checkout flow if you run an online store. You can roll back to the previous version from the same menu at any time if something breaks.
• If you have file upload forms, test them explicitly after switching PHP versions. Uploads work normally, but it is worth a quick check in the context of your specific application.
• If something stops working after the PHP version change, open a support ticket and we will help you identify the issue. Do not leave the site broken without reaching out.
• Keep recent backups. JetBackup in cPanel lets you schedule daily backups. In a security incident, a recent backup is your fastest recovery option.

If you are unsure which PHP version is compatible with your application or a specific plugin, send us a support ticket before making the switch and we will check it together.