Critical PHP RCE Vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Patch Your Servers Now

Two critical remote code execution (RCE) vulnerabilities have been disclosed in PHP, a widely used programming language that powers websites, content management systems, and web applications.

Tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities could allow unauthenticated attackers to execute arbitrary code on affected servers. Successful exploitation may compromise server security, expose sensitive information, or disrupt business services.

Given the severity of these vulnerabilities, administrators should identify affected PHP installations and apply the appropriate security updates as soon as possible.

Vulnerability Details

The two vulnerabilities affect PHP's internal request-handling mechanisms and may lead to unsafe memory operations that could be exploited for remote code execution.

The vulnerabilities may affect PHP environments serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, and other PHP application server configurations.

For technical details, consult the official records:

• CVE-2026-109618
• CVE-2026-109619
• PHP Official Security Advisory

Affected and Fixed PHP Versions

The reported vulnerabilities affect PHP versions from PHP 5 onward, including older releases that are no longer supported by the upstream PHP project.

The following upstream PHP releases contain the fixes:

Important: PHP 8.1 and earlier do not have corresponding upstream fixes listed here. Some operating system vendors may provide backported security patches. Check the relevant vendor advisory to confirm whether your installed package has been patched.

How to Check and Secure Your Server

We recommend the following steps for administrators running PHP-based websites or applications.

Step 1: Check Your PHP Version

Run the following command to check the PHP CLI version installed on your server:

php -v

Review the output and compare your installed version with the fixed PHP releases listed above.

Step 2: Identify All PHP Installations

If your server hosts multiple websites or uses multiple PHP versions, check each installation separately.

For Linux servers, run:

which php
whereis php

On Debian or Ubuntu, list installed PHP packages with:

dpkg -l | grep -E 'php[0-9.]'

If you use PHP-FPM or a hosting control panel, verify the PHP version assigned to each website. The CLI version may differ from the version used by your web applications.

Step 3: Install the Security Updates

For Ubuntu or Debian, check the relevant distribution security advisory and install the applicable security updates through your package manager.

Update the package lists:

sudo apt update

Review available package updates:

apt list --upgradable

Install the applicable PHP security updates after confirming the correct packages for your environment.

Important: Ubuntu and Debian may backport security fixes without changing the upstream PHP version number to the versions listed above. Check the official distribution security tracker to confirm whether your installed package has been patched.

• Ubuntu Security Notices
• Debian Security Tracker

For other Linux distributions, use the official security advisories and package repositories provided by your operating system vendor.

If PHP was compiled from source, installed through a third-party repository, or managed by a hosting control panel, follow the corresponding vendor's upgrade procedure. Make sure every PHP version used by your websites is updated.

Step 4: Restart the Relevant Services

After applying the updates, restart the affected PHP-FPM or web server services as required by your configuration.

For example, if your server uses PHP 8.4 FPM:

sudo systemctl restart php8.4-fpm

The service name may differ depending on your installed PHP version and server configuration.

Step 5: Verify the Update

Check the PHP CLI version again:

php -v

For distribution-managed packages, verify the installed package revision against the relevant security advisory rather than relying solely on the upstream version number.

Finally, test your websites and applications to confirm they are functioning correctly after the update.

Step 6: Review Server Security

Applying security updates addresses the known vulnerabilities, but it does not rule out a previous compromise.

Review relevant system and web server logs for suspicious requests, unexpected processes, unauthorized file changes, unfamiliar accounts, or unusual outbound connections.

If you discover indicators of compromise, investigate the incident separately and take appropriate incident response measures. Depending on the findings, additional actions may include credential rotation, malware investigation, or restoration from a known-good backup.

What If You Cannot Update Immediately?

Updating to a fixed version or installing a verified vendor-provided security patch is the recommended remediation.

If an immediate update is not possible, prioritize internet-facing PHP services and assess whether vulnerable applications can be temporarily isolated from untrusted networks until remediation is complete.

Network restrictions and web application firewalls may reduce exposure in some environments, but they should not be treated as a substitute for installing the security fixes.

For end-of-life PHP versions without an upstream fix, plan an upgrade to a supported PHP release or verify the availability of an appropriate vendor-provided security patch.

How Database Mart Customers Can Get Help

If you host PHP-based websites or applications on a Database Mart server, we recommend reviewing your PHP installations and applying the appropriate security updates promptly.

If you are unsure which PHP version your applications use or encounter issues while updating, contact our technical support team with your operating system version, PHP installation method, affected PHP version, and any relevant error messages.

Please note that customers are responsible for maintaining and updating software installed within their servers unless a separate managed service agreement specifies otherwise.

Official Security References

• PHP Official Security Advisory
• CVE-2026-109618 — CVE.org
• CVE-2026-109619 — CVE.org
• Ubuntu Security Notices
• Debian Security Tracker

Final Recommendation

These vulnerabilities present a serious security risk to PHP-based services. Administrators should inventory their PHP installations, prioritize internet-facing systems, apply the appropriate security updates, and investigate any signs of potential compromise.

Do not delay remediation. Update your affected PHP installations as soon as possible to help protect your websites, applications, and server infrastructure.