PHP and Node.js Security, Part 1: The October 2026 PHP RCE Fixes

Two runtimes, one rough month. This series covers the 2026 PHP and Node.js security releases, as of 26 Oct 2026: what's affected, what fixes it, and what happens to a site that waits. Part 1 is PHP. Every fact comes from vendor advisories, listed at the bottom.

TL;DR

• CVE-2026-109618 and CVE-2026-109619: both Critical (CVSS v4.0 9.2), both unauthenticated remote code execution.
• Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• "There are no complete mitigations, updating is the only safe choice."
• PoC public since 22 Oct; as of 26 Oct 2026 not in CISA's KEV catalog.

The two critical CVEs from 21 October

CVE-2026-109618: when PHP runs out of memory mid-request it bails out with longjmp(), and if request state is half-built, cleanup treats it as valid. Crafted multipart uploads push memory to the limit. The advisory says full RCE was validated over HTTP against mod_php with default limits and prefork; the fix removes longjmp() on out-of-memory. CVE-2026-109619: request state survives after its memory is freed, and the next request on the same worker uses it. The named paths are INI diagnostics before request startup, session upload progress and, on 8.5, fatal_error_backtraces.

Who is affected, and which version fixes it

php.net: "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed". mod_php is riskiest, with "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

Check your PHP version and SAPI

php -v
php -i | grep -i "Server API"
# Debian/Ubuntu web packages
dpkg -l | grep -E 'php[0-9.]*-(fpm|cgi)|libapache2-mod-php'

What happens if you don't patch

• Anyone who can reach the site can run code as your web worker account, no login needed.
• Memory from other requests can leak (CVE-2026-109619).
• On mod_php it fires before your app code, so app-level checks never get a vote.

Whatever that account can touch, an attacker can. Part 3 covers what a hacked site does to rankings.

Stopgaps if you can't patch tonight

; php.ini
session.upload_progress.enabled = 0
; php.ini, PHP 8.5 only
fatal_error_backtraces = 0
; PHP-FPM pool config (www.conf)
pm.max_requests = 1

A 23 Oct follow-up, CVE-2026-115560, hits session upload progress when session.serialize_handler is switched to php via ini_set(). No fixed release yet; the same upload-progress switch mitigates it.

Is anyone exploiting it?

Sophos reported a public proof of concept on 22 Oct, then corrected its post: "there is no evidence of a successful compromise". Neither CVE is in CISA's KEV catalog (version 2026.10.23). Public PoC plus a 9.2 score means patch now.

What "later" looked like: CVE-2024-4577

A Windows PHP-CGI argument injection that bypassed the old CVE-2012-1823 fix; default XAMPP was vulnerable. Fixed in 8.1.29, 8.2.20 and 8.3.8, it went into CISA's KEV catalog on 12 Jun 2024 with known ransomware use. CVE-2019-11043 (PHP-FPM) is KEV-listed too. Old PHP bugs don't age out.

Also missed: 24 Sep (8.5.11 and siblings: OpenSSL, TLS hostname, PHP-FPM and redirect-credential fixes) and 30 Jul (8.5.9 and siblings: PgSQL SQL injection CVE-2026-17543). 8.5.12 and its siblings are newer than both.

Printable version: PHP + Node.js security patch checklist (PDF). Or hand it to our website maintenance and security patching team.

The whole series

1. Part 1: The October 2026 PHP RCE fixes (this post)
2. Part 2: The Node.js October 2026 security release
3. Part 3: What unpatched servers do to SEO