Critical PHP Security Update: Two RCE Flaws Fixed in PHP 8.2 to 8.5 (October 2026)

News · 27 October 2026

On 21 October 2026 the PHP project shipped an urgent PHP security update: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can let an attacker run code on a server without logging in. If your website runs on PHP (WordPress, WooCommerce, WHMCS, Laravel and most other web apps do), this one matters.

What happened

According to the official PHP security advisory (21 October 2026), the two issues are:

• CVE-2026-109618: remote code execution through memory corruption when PHP hits an out-of-memory condition while request data (such as a file upload) is only partly set up.
• CVE-2026-109619: remote code execution through internal state that survives after its memory has been freed, which a later request on the same worker can use.

Both are rated CVSS v4.0 9.2, according to cPanel’s response post (26 October 2026). PHP says every PHP install that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php. PHP 8.1 and older no longer get official updates, though the PHP team published minimal source backports for 7.4, 8.0 and 8.1.

cPanel released fixed EasyApache 4 PHP packages (v25.91 and v25.92) on 21 October, including backported fixes for ea-php74, ea-php80 and ea-php81, and security builds of cPanel & WHM 138.0.18, 136.0.50, 134.0.66 and 110.0.153. Its support article notes that EasyApache 4 packages for PHP 7.3 and older did not get this fix.

What it means for site owners

In plain words: these bugs are in PHP itself, not in a plugin or theme. A fully updated WordPress site can still be exposed if the server’s PHP is old. On shared hosting your host updates PHP for you. On your own VPS, VDS or dedicated server, updating PHP is your job.

PHP also notes that PHP 8.2 reaches end of life on 31 December 2026, so now is a good time to move sites to PHP 8.3 or newer.

What to do now

1. Check your PHP version. In cPanel, open MultiPHP Manager or Select PHP Version, or create a temporary phpinfo page and delete it afterwards.
2. On shared hosting: switch old sites to PHP 8.3 or newer after testing them. If a site still needs PHP 7.x, plan an upgrade.
3. On your own cPanel server: update cPanel & WHM and EasyApache 4 packages, then restart PHP-FPM and Apache. cPanel’s article lists these commands:

# AlmaLinux / Rocky / CentOS
yum clean all && yum makecache
# Ubuntu
apt clean && apt update

/scripts/update-packages

# confirm the fix is in your PHP build (replace php81 with your version)
rpm -q --changelog ea-php81-php-cli | grep -m1 CVE-2026-109618

4. Other servers: install the fixed PHP package from your distribution, control panel or LTS vendor, then restart all PHP workers.
5. If you cannot update today: PHP lists partial mitigations, such as session.upload_progress.enabled=0 and a low post_max_size. PHP is clear that these reduce exposure but do not make a server safe. Only the update is a full fix.

Need help?

If you run your own server, a current cPanel licence keeps you on supported cPanel & WHM builds that receive security releases like this one. If you would rather not manage PHP updates yourself, our WordPress hosting is a managed option. Questions? Email support@shohost.com or WhatsApp +91 94880 91432 (9 AM to 12 midnight IST).

Sources: PHP News Archive (21 and 23 October 2026); cPanel blog (26 October 2026); cPanel support article (22 October 2026).