Critical PHP Security Updates: What Website and Server Administrators Need to Do

CYBER FRIDAYS · OCTOBER 24, 2026

PHP released security updates on October 21 for two critical vulnerabilities. On October 23, the PHP team also disclosed a separate, less common remote-code-execution scenario that needs a configuration mitigation.

What happened?

The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. CERT-EU warns that both vulnerabilities can enable unauthenticated remote code execution. Proof-of-concept code is circulating, which makes timely patching important.

A third vulnerability is different

CVE-2026-115560, disclosed on October 23, is not fixed by the October 21 releases. PHP says it requires an unusual combination of session serialization configuration and application behavior. Until the next regular bugfix release, the PHP team recommends setting session.upload_progress.enabled=0. Applications that never change their session serialization handler at runtime are not exposed to this particular issue.

What should administrators do?

1. Inventory the PHP versions running on production, staging, and development servers.
2. Upgrade supported branches to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as applicable.
3. Review and test the PHP team’s session upload progress mitigation for CVE-2026-115560.
4. Review relevant web server and application logs and investigate suspicious activity.
5. Remember that updating WordPress or another CMS does not automatically update the server’s PHP runtime.

Sources and further reading

• PHP official advisory
• Canadian Centre for Cyber Security
• CERT-EU advisory
• BleepingComputer coverage

Cyber Fridays — original IT and cybersecurity commentary by John Brown. Check the latest vendor advisory before changing production systems.