The PHP project released fixes today for two critical vulnerabilities that can allow unauthenticated remote code execution. They are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP rates each 9.2 on CVSS v4.0. If PHP runs anywhere in your environment, please update it today. PHP states that updating is the only safe choice.
These vulnerabilities are bugs in PHP's underlying C code, not in the applications running on it. Contrast does not protect against these vulnerabilities. They are flaws in PHP itself, not in your application. To fix them, install a patched version of PHP.
What to do
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, starting with internet-facing systems. This means the PHP runtime itself, since updating an application such as WordPress or Laravel does not patch PHP. Restart PHP-FPM or your web server afterward and confirm the running version.
- If you run PHP 8.1 or older, the PHP project issues no updates for those versions. Upgrade to a fixed version, or ask your vendor about a backported fix.
-
If you cannot update today, apply the interim measures PHP lists in its advisory. PHP is clear that they reduce exposure to specific attack paths and do not make an installation safe, so keep the update on the calendar and restrict access to the system until it is done. If you use a web application firewall or CDN, confirm your provider's emergency rules for these CVEs are enabled in block mode, and treat them as an added layer, not a replacement for the update. The measures are below.
- For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. Set a low post_max_size (8M if you do not need uploads, 32M if you do), keep upload_max_filesize below it, and enforce request size, field count, and header limits at your web server or proxy. Use a container or cgroup limit that kills only the affected worker, and do not use RLIMIT_AS or RLIMIT_DATA.
- For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or your FPM pool or server configuration, then restart every worker. Do not rely on ini_set() or .user.ini. On PHP 8.5, also set fatal_error_backtraces=0 and restart. Remove invalid or deprecated per-request settings that emit diagnostics, and fix attacker-reachable fatal errors and execution timeouts.
- Check web server and PHP logs from at least October 20 forward for web server processes starting shells, download tools, or unexpected outbound connections. If you find any, isolate the host and start your incident response process.
PHP's full advisory is at https://www.php.net/archive/2026.php#2026-10-21-5.
We have assessed our own environment and have not identified exposure to these vulnerabilities. Our customer-facing platform does not run on PHP. If you use the Contrast PHP agent, it runs inside your own PHP environment, so the update guidance above applies to the hosts where it runs.
Questions go to your account manager or support@contrastsecurity.com.