On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS v4 scale and neither needs a login, so a request can trigger them before your application code has even run.
A week on, it has moved from "patch when you can" to "patch now". Cloudflare and Hadrian both reported attack traffic on the day of release, and CISA added both flaws to its Known Exploited Vulnerabilities list on 26 October, with a deadline of 29 October for US federal agencies. The reports disagree on whether any attack has actually got through, so we won't claim a compromise, but there's no reason to wait to find out.
What the flaws are
CVE-2026-109618 is memory corruption when PHP runs out of memory part way through setting up a request. CVE-2026-109619 is state from one request surviving into the next one on the same worker. The risk is highest on mod_php, where the attack lands before your code runs.
PHP's own advice is that no setting fully protects you and updating is the only complete fix. Turning off session.upload_progress.enabled reduces exposure, but it doesn't make an unpatched install safe.
What to check
First, the version your website is actually running. The version on the command line is often not the one serving your site, and a hosting panel can show something different again. Make sure the running version is 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.
Second, restart after you update. PHP workers keep running the old code until they're restarted, and so do long-running queue workers, so an update with no restart can leave you exposed while looking patched.
Third, if you're on PHP 8.1 or older, the PHP project no longer fixes those. Some Linux distributions have backported fixes for 7.4, 8.0 and 8.1, so ask your host whether yours has. Realistically that's a stopgap, and the proper answer is moving up a version. PHP 8.2 reaches end of life on 31 December, so that move is worth planning now rather than in December.
Magento and Laravel stores
Both run on PHP, so both are affected. If your store is on Magento, check which PHP version your release supports before you jump, because the newest PHP is not always supported yet. If it's stuck on an old PHP because of an extension, that's the thing to sort.
If you're not sure what version your store is running, or whether a restart happened, send us the URL and we'll check.
Sources: PHP.net news, BleepingComputer, Rescana summary of the CISA listing
