# PHP and Node.js Security, Part 1: The October 2026 PHP RCE Fixes

> PHP CVE-2026-109618 and CVE-2026-109619 explained: affected SAPIs, fixed versions 8.2.35 to 8.5.12, stopgaps, and what happens to a server you don't patch.

Source: https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php · Published 2026-10-26 · ByteVancer · Security

**Two critical PHP bugs hit every PHP install that serves web requests. The fixed versions, how to check yours, and what an unpatched server risks.**

> **Part 1 of 3: PHP and Node.js security, October 2026** — **Part 1: The October 2026 PHP RCE fixes (you're here)** · [Part 2: The Node.js October 2026 security release](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-2-nodejs) · [Part 3: What unpatched servers do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers)

Two runtimes, one rough month. This series covers the 2026 PHP and Node.js security releases, as of 26 Oct 2026: what's affected, what fixes it, and what happens to a site that waits. Part 1 is PHP. Every fact comes from vendor advisories, listed at the bottom.

## TL;DR

- CVE-2026-109618 and CVE-2026-109619: both Critical (CVSS v4.0 9.2), both unauthenticated remote code execution.
- Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- "There are no complete mitigations, updating is the only safe choice."
- PoC public since 22 Oct; as of 26 Oct 2026 not in CISA's KEV catalog.

## The two critical CVEs from 21 October

**From the php-src GitHub security advisories.**
- **CVE-2026-109618** — Name: RCE via OOM corruption; Vendor-stated impact: Unauthenticated remote code execution as the web worker account
- **CVE-2026-109619** — Name: RCE via stale global state; Vendor-stated impact: Unauthenticated heap use-after-free, memory disclosure and remote code execution

CVE-2026-109618: when PHP runs out of memory mid-request it bails out with longjmp(), and if request state is half-built, cleanup treats it as valid. Crafted multipart uploads push memory to the limit. The advisory says full RCE was validated over HTTP against mod_php with default limits and prefork; the fix removes longjmp() on out-of-memory. CVE-2026-109619: request state survives after its memory is freed, and the next request on the same worker uses it. The named paths are INI diagnostics before request startup, session upload progress and, on 8.5, fatal_error_backtraces.

## Who is affected, and which version fixes it

php.net: "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed". mod_php is riskiest, with "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

**php.net advisory and supported-versions page, as of 26 Oct 2026.**
- **8.5** — Fixed in: 8.5.12; Support status: Security fixes to 31 Dec 2029
- **8.4** — Fixed in: 8.4.27; Support status: Security fixes to 31 Dec 2028
- **8.3** — Fixed in: 8.3.36; Support status: Security fixes to 31 Dec 2027
- **8.2** — Fixed in: 8.2.35; Support status: Security-only, ends 31 Dec 2026
- **8.1, 8.0, 7.4** — Fixed in: Source backports only; Support status: End of life

## Check your PHP version and SAPI

*Read-only. The CLI build can differ from your web server's; confirm in your hosting panel too.*
```bash
php -v
php -i | grep -i "Server API"
# Debian/Ubuntu web packages
dpkg -l | grep -E 'php[0-9.]*-(fpm|cgi)|libapache2-mod-php'
```

## What happens if you don't patch

- Anyone who can reach the site can run code as your web worker account, no login needed.
- Memory from other requests can leak (CVE-2026-109619).
- On mod_php it fires before your app code, so app-level checks never get a vote.

Whatever that account can touch, an attacker can. [Part 3](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers) covers what a hacked site does to rankings.

## Stopgaps if you can't patch tonight

**CVE-2026-109618** — memory_limit=-1, a low post_max_size or cgroup limits. RLIMIT_AS/RLIMIT_DATA don't help.

**CVE-2026-109619** — Turn off upload progress (and backtraces on 8.5); recycle FPM workers.

```ini
; php.ini
session.upload_progress.enabled = 0
; php.ini, PHP 8.5 only
fatal_error_backtraces = 0
; PHP-FPM pool config (www.conf)
pm.max_requests = 1
```

*Partial mitigations from the advisories. They shrink the window; they don't close it.*

A 23 Oct follow-up, CVE-2026-115560, hits session upload progress when session.serialize_handler is switched to php via ini_set(). No fixed release yet; the same upload-progress switch mitigates it.

## Is anyone exploiting it?

Sophos reported a public proof of concept on 22 Oct, then corrected its post: "there is no evidence of a successful compromise". Neither CVE is in CISA's KEV catalog (version 2026.10.23). Public PoC plus a 9.2 score means patch now.

## What "later" looked like: CVE-2024-4577

A Windows PHP-CGI argument injection that bypassed the old CVE-2012-1823 fix; default XAMPP was vulnerable. Fixed in 8.1.29, 8.2.20 and 8.3.8, it went into CISA's KEV catalog on 12 Jun 2024 with known ransomware use. CVE-2019-11043 (PHP-FPM) is KEV-listed too. Old PHP bugs don't age out.

Also missed: 24 Sep (8.5.11 and siblings: OpenSSL, TLS hostname, PHP-FPM and redirect-credential fixes) and 30 Jul (8.5.9 and siblings: PgSQL SQL injection CVE-2026-17543). 8.5.12 and its siblings are newer than both.

Printable version: [PHP + Node.js security patch checklist (PDF)](https://bytevancer.com/downloads/php-nodejs-security-patch-checklist-oct-2026.pdf). Or hand it to our [website maintenance and security patching](https://bytevancer.com/services/maintenance-support) team.

## The whole series

1. **Part 1: The October 2026 PHP RCE fixes (this post)**
2. [Part 2: The Node.js October 2026 security release](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-2-nodejs)
3. [Part 3: What unpatched servers do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers)

## Frequently asked questions

**Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?**
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 7.4, 8.0 and 8.1 only get minimal source backports.

**Am I affected if I use PHP-FPM instead of mod_php?**
Yes. php.net says all PHP installations serving web requests are affected, including PHP-FPM. mod_php carries the highest risk.

**Can I mitigate the PHP vulnerabilities without upgrading?**
Only partially. php.net says there are no complete mitigations and updating is the only safe choice.

**Are CVE-2026-109618 and CVE-2026-109619 being exploited?**
As of 26 Oct 2026 a proof of concept is public, Sophos reports no evidence of a successful compromise, and neither is in CISA's KEV catalog.

**How do I check my PHP version?**
Run php -v, and php -i | grep -i "Server API" for the SAPI.

## Keep reading

- [PHP and Node.js Security, Part 2: The Node.js October 2026 Release](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-2-nodejs) — The Node.js October 2026 security release: 10 CVEs, including a high-severity Brotli bug, fixed in v22.23.4, v24.22.1 and v26.12.1, plus EOL lines still open.
- [PHP and Node.js Security, Part 3: What Unpatched Servers Do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers) — How an unpatched PHP or Node.js server hurts SEO: Google's "This site may be hacked" label, browser interstitials, 5xx crawl slowdown, and what to patch first.
- [All ByteVancer engineering articles](https://bytevancer.com/blog)

## Rather not chase PHP patch days yourself?

We patch, test and monitor PHP and Node.js sites on a schedule. See our [PHP security patching and website maintenance](https://bytevancer.com/services/maintenance-support) or [talk to the team](https://bytevancer.com/contact).

## Sources

- [PHP.net — Security advisory for CVE-2026-109618 and CVE-2026-109619 (Oct 21, 2026)](https://www.php.net/archive/2026.php#2026-10-21-5)
- [php-src advisory GHSA-w8hw-w9fx-j79w — CVE-2026-109618, RCE via OOM corruption](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
- [php-src advisory GHSA-6wmf-4rv5-p3rp — CVE-2026-109619, RCE via stale global state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)
- [PHP.net — Follow-up advisory, CVE-2026-115560 (Oct 23, 2026)](https://www.php.net/archive/2026.php#2026-10-23-1)
- [Sophos — Proof-of-concept exploit released for PHP vulnerabilities (Oct 22, 2026, corrected 21:21 UTC)](https://www.sophos.com/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619)
- [CISA — Known Exploited Vulnerabilities catalog feed (version 2026.10.23)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [php-src advisory GHSA-3qgc-jrrr-25jv — CVE-2024-4577, PHP-CGI argument injection](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)
- [PHP.net — 2026 news archive (Jul 30 and Sep 24 security releases)](https://www.php.net/archive/2026.php)
- [PHP.net — PHP 8 ChangeLog, 8.5.11](https://www.php.net/ChangeLog-8.php#8.5.11)
- [PHP.net — Supported versions (checked Oct 26, 2026)](https://www.php.net/supported-versions.php)

---

*This is the Markdown copy of https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php — the page itself has the interactive charts and diagrams.*