PHP - CVE-2026-109618
Last updated: October 21, 2026 - 7:04 p.m. (CEST)
Affected CVEs
The security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are critical vulnerabilities that could allow an attacker to gain extensive access to the server.
The software vendor (PHP) released security updates on October 21, 2026, at 4:00 p.m. that address the vulnerability in current PHP versions.
Affected PHP Versions
| PHP Branch | Fixed Version |
|---|---|
< 7.4 | ⚠️ No security update is provided |
7.4 | ⚠️ No security update is available |
8.0 | ⚠️ No security update is available |
8.1 | ⚠️ No security update is available |
8.2 | ✅ 8.2.35 |
8.3 | ✅ 8.3.36 |
8.4 | ✅ 8.4.27 |
8.5 | ✅ 8.5.12 |
What do you need to know?
Servers with the "Managed" support level
For all servers with the "Managed" support level, the necessary updates for PHP 8.2, 8.3, 8.4, and 8.5 have already been installed.
If your websites use at least PHP 8.2, no further action is required on your part.
If you are still using a PHP version that has not received a security update, we strongly recommend that you ensure your web application is compatible with at least PHP 8.2.
Servers with the "Unmanaged" support level
If you are operating affected servers at the “Unmanaged” support level, we recommend that you install the security updates as soon as possible to protect your applications and the associated data.
You can find information from the vendor here: https://www.php.net/archive/2026.php#2026-10-20-1
Potential Issues with Deploying the Updates
Please note that due to the extremely high number of affected websites worldwide, the official repository servers may be slower than usual or may temporarily stop responding altogether due to the heavy load.
Regardless, our APT mirror servers already contain the necessary updates and can therefore be used without restriction.
creoline PHP Mirror (Ubuntu + Debian):
https://mirror.creoline.net/php/You can find all the information you need to integrate our repository servers here:
https://help.creoline.com/de/en/doc/apt-repositories-11fsvs6vsI#php
Frequently Asked Questions
Will the deployment of the PHP update cause any downtime?
No, no downtime is expected as a result of the PHP update deployment.
Is my server on the “Managed” or “Unmanaged” support level?
You can view your server’s support level in the server overview. Managed servers are marked with a green checkmark. This information is also available in the server details view.