Skip to Content

News

Critical PHP Security Vulnerabilities — Immediate Action Required

Thu, Oct 22, 2026 at 1:26 PM

Severity: Critical

Action: Update web-facing PHP installations to a security-patched release as soon as possible.

Summary

The PHP project has disclosed two critical vulnerabilities that could allow unauthenticated remote code execution on PHP installations serving web requests:

  • CVE-2026-109618: Out-of-memory handling corruption
  • CVE-2026-109619: Stale internal global state

The vulnerabilities affect web-facing PHP deployments, including PHP-FPM and Apache with mod_php. PHP identifies mod_php as the highest-risk configuration. Updating to a fixed release is the complete solution; temporary mitigations do not fully secure an installation.

Source: PHP security advisory

PHP upgrade guidance

Upgrade within your current PHP branch to the fixed upstream release below or install the security-patched package provided by your operating system vendor.

Current PHP version  Fixed upstream version 
PHP 8.4.x  PHP 8.4.27 or later patched release 
PHP 8.3.x  PHP 8.3.36 or later patched release 
PHP 8.2.x  PHP 8.2.35 or later patched release 
PHP 8.1.x or older  Check with your OS/LTS vendor for a security backport and plan a move to a supported PHP version. 

 

Linux distributions may backport fixes without changing PHP to the upstream version listed above. Follow your distribution’s security notice and confirm the package fixes both CVEs for the PHP branch you run.

PHP 8.5 is not supported by Ezeelogin. Do not upgrade an Ezeelogin installation to PHP 8.5.

Ezeelogin packages

Same PHP branch: Updating within the same branch (for example, PHP 8.2.19 to 8.2.35) does not require an Ezeelogin software or package upgrade solely for this PHP security fix. Use the package table only when changing PHP branches. Back up Ezeelogin before applying a package and follow its update procedure.

PHP version  Ezeelogin package 
PHP 8.4.x  Ezeelogin 7.47.0 for PHP 8.4 
PHP 8.2.x or 8.3.x  Ezeelogin 7.47.0 for PHP 8.2/8.3 
PHP 8.1.x  Ezeelogin 7.47.0 for PHP 8.1 

Operating system security notices

Check your vendor’s guidance for patched packages and update instructions. Distribution package numbers may differ from upstream PHP version numbers.

Distribution  Advisory or update guidance 
Ubuntu  USN-8948-1 and USN-8948-2 list fixed packages for Ubuntu releases. 
Debian  Debian PHP security tracker lists affected and fixed packages and links to Debian advisories. 
CloudLinux  Package status and update instructions cover native PHP, alt-php, and ea-php. 
AlmaLinux  Patched packages are reported in production repositories for AlmaLinux 8, 9, and 10. 
Gentoo  GLSA 202610-02 lists fixed PHP releases and upgrade commands. 
Rocky Linux  No Rocky-specific advisory was identified as of 22 October 2026. Check Rocky Linux Errata for curre… 
CentOS  No CentOS-specific advisory was identified as of 22 October 2026. Check your CentOS release’s package updates and official security announcements. 

 

For Rocky Linux or CentOS, verify that an update applies to your release and installed PHP packages before installing it.

References