Emergency PHP security release: what to check on your server

What happened

On 21 October PHP released fixes for two critical vulnerabilities, both rated 9.2 under CVSS v4.0. They allow code execution on the server without authentication, with a single request to the site. Details are in the PHP advisory.

CVE-2026-109618 — corruption on out-of-memory: PHP can be interrupted while request data is only partially initialized and later treat it as valid.
CVE-2026-109619 — stale global state: data of one request can survive it and reach the next request handled by the same worker.

According to PHP, the risk is highest for Apache with mod_php: an exploit has been demonstrated that triggers before any application code runs. No attacks had been reported at the time of publication.

ForestsNet Cloud servers are unmanaged: you update PHP on your own VPS. Below is how to check and update. If something does not work, write to support and we will help.

Who is affected

Anyone whose PHP serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. In practice that means websites and online stores, WordPress, Bitrix and other CMSs, PHP-based control panels and apps, containers with PHP. If there is no PHP on your server, there is nothing to do.

How to check

php -v — the command-line PHP version.
php-fpm -v or, on Debian and Ubuntu, php-fpm8.3 -v with your version — PHP-FPM, which serves sites behind nginx.
apache2ctl -M | grep -i php on Debian and Ubuntu or httpd -M | grep -i php on AlmaLinux and Rocky Linux — the PHP module in Apache.
docker ps --format '{{.Image}}' — container images: look for php, wordpress and other PHP-based images.

How to update

Debian and Ubuntu: apt update && apt upgrade. Distributions received the fixes in advance. This also updates PHP from the Ondřej Surý repository if you use it.
AlmaLinux and Rocky Linux: dnf upgrade 'php*'. If PHP comes from the Remi repository, there will be no updates there today, as PHP itself says. It recommends switching to distribution packages or building from source; until you update, apply the temporary measures below.
After updating, restart PHP-FPM: systemctl restart php8.3-fpm with your version on Debian and Ubuntu, or systemctl restart php-fpm on AlmaLinux and Rocky Linux. If PHP runs as an Apache module, restart Apache: systemctl restart apache2 or systemctl restart httpd.
PHP installed by a control panel should be updated through the panel itself.

Distributions build PHP themselves and backport fixes into their packages, so the version number on your system may differ from php.net. What matters is that PHP packages got an update on 21 October or later.

Docker

Official images: once fixed tags are published — docker compose pull && docker compose up -d.
Your own images based on php: rebuild with a fresh base — docker compose build --pull && docker compose up -d.

If you cannot update right away

PHP lists temporary measures. They only block the confirmed attack paths and do not make a server safe — only the update is a complete fix.

session.upload_progress.enabled = 0 in php.ini or the FPM pool settings, then restart every PHP worker. Setting it via ini_set() or .user.ini does not work.
post_max_size = 8M if the site does not need file uploads, or 32M if it does; keep upload_max_filesize below that value.
Other measures, including ones for PHP 8.5, are in the PHP advisory.

Fixed versions

The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. There are no releases for PHP 8.1 and older: PHP no longer supports them. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for those who build PHP themselves, and ready-made packages come from distributions and LTS vendors. Such a site is worth moving to a current PHP branch.