Critical PHP Vulnerabilities in 2026: How to Check, Patch and Protect Your Server

Two critical vulnerabilities affecting the PHP programming language have prompted urgent security updates for website owners, hosting providers and server administrators.

Disclosed on October 21, 2026, CVE-2026-109618 and CVE-2026-109619 can potentially allow attackers to execute malicious code on vulnerable PHP servers without authentication. Both vulnerabilities carry a CVSS 4.0 severity score of 9.2 (Critical).

If your website runs WordPress, WHMCS, Magento, Laravel, or another PHP-based application, checking the PHP runtime installed on your server should be a priority.

The good news is that security patches are available for supported PHP versions. However, applying an update is only part of the process. Server administrators also need to confirm that the correct packages have been installed and that their websites are actually running the patched PHP components.

To help simplify that process, WebCare360 has developed a free PHP Vulnerability Checker & Patch Tool that audits installed PHP packages, checks available patch evidence and provides detailed security reports.

What are CVE-2026-109618 and CVE-2026-109619?

These two security vulnerabilities affect PHP's internal memory handling. They are particularly serious because successful exploitation may allow an attacker to execute code remotely without having a legitimate account on the affected website.

CVE-2026-109618: Out-of-memory handling vulnerability

This vulnerability involves how PHP handles certain out-of-memory conditions during request processing.

Under specific circumstances, PHP may leave internal request data improperly initialized. Subsequent cleanup operations can interact with this invalid memory state.

Attackers may be able to exploit these conditions to trigger memory corruption and potentially achieve remote code execution.

CVE-2026-109619: Stale internal state vulnerability

The second vulnerability involves internal PHP state that can continue referencing request memory after that memory has been released.

When PHP workers process multiple requests, stale state may be accessed before it is properly reset. Under exploitable conditions, this can result in unauthorized memory access or remote code execution.

Both vulnerabilities are documented by the PHP security team and require prompt remediation.

Official references:

• PHP Security Advisory - October 21, 2026

• CVE-2026-109618

• CVE-2026-109619

Why outdated PHP versions put your website at risk

PHP is responsible for processing server-side application code. Unlike JavaScript that runs in a visitor's browser, PHP typically executes on the hosting server, where it may interact with databases, application files and other sensitive resources.

If an attacker successfully exploits a PHP runtime vulnerability, the consequences can extend beyond a single web page.

Potential impacts include:

• Unauthorized code execution: An attacker may execute commands with the permissions available to the affected PHP process.

• Sensitive data exposure: Application configuration files, credentials, customer information or database connections may become accessible.

• Website modification: Attackers may inject malicious content, change application files or redirect visitors.

• Malware installation: A compromised website may be used to distribute malware or host unauthorized scripts.

• Service disruption: Exploitation may crash PHP workers or interfere with the availability of hosted applications.

• Additional compromise: An attacker may attempt to access other resources reachable from the compromised account or service.

The actual impact depends on the hosting environment, application permissions, isolation controls and whether exploitation is successful.

Updating WordPress, WHMCS, or your application plugins does not automatically patch a vulnerability in the underlying PHP runtime.

The server-side PHP installation must be addressed separately.

Which PHP versions are affected?

The PHP security team released fixes on October 21, 2026.

The following versions represent the minimum fixed upstream releases for the affected supported branches.

Important: PHP 8.1 and older versions are outside upstream security support and did not receive corresponding upstream releases.

If your server runs an unsupported PHP branch, plan a migration to a supported version or consult your operating system or hosting vendor regarding maintained, backported security fixes.

What about CloudLinux, cPanel and vendor-patched PHP?

Not every secure PHP installation will display one of the upstream version numbers listed above.

Hosting environments such as CloudLinux, cPanel and supported Linux distributions may provide security fixes through vendor-maintained packages.

These packages can contain the required vulnerability fixes while retaining an older upstream PHP version identifier.

For example, Ubuntu publishes fixed package build numbers that differ from upstream PHP release numbers.

This is why checking only php -v is not always sufficient to determine whether a server is vulnerable.

The installed package release, vendor security advisory and actual PHP runtime must also be considered.

How to check whether your server is patched

Start by identifying the PHP versions installed on your server.

On a Linux system, the following command displays the default command-line PHP version:

php -v

However, the CLI version may not match the PHP version used by your website.

A hosting server can run multiple PHP versions simultaneously, particularly when using cPanel, CloudLinux, PHP-FPM, LiteSpeed or separate application environments.

For example, the default CLI may use PHP 8.4 while an individual website still uses PHP 8.1.

On multi-PHP hosting systems, check every installed and active PHP runtime rather than relying on a single version number.

You should also review the security updates provided by your operating system and hosting control panel vendor.

Introducing the free WebCare360 PHP Vulnerability Checker & Patch Tool

To make PHP security verification easier, we have developed a lightweight Bash-based utility designed to help Linux server administrators assess the patch status of their PHP installations.

The tool focuses on:

CVE-2026-109618 and CVE-2026-109619

It can identify installed PHP package families, compare supported package versions against known fixed baselines, examine available security changelog evidence and generate reports for further investigation.

What the tool can do

• Detect basic server details, including hostname, operating system and available package manager.

• Identify cPanel and selected third-party hosting panels.

• Detect CloudLinux environments.

• Inspect installed PHP package families, including supported EA-PHP and Alt-PHP packages.

• Evaluate known upstream PHP security release baselines.

• Check selected vendor-specific fixed package builds and available changelog evidence.

• Identify certain custom PHP binaries and container environments requiring additional verification.

• Look for signs of running workers using deleted PHP executables or libraries.

• Produce readable terminal results and local HTML and text reports.

• Offer an optional, administrator-approved package update workflow for supported environments.

The tool is intended to assist with server auditing and patch verification. It does not replace vendor security advisories, a complete server inventory or manual validation of custom PHP installations.

How to download and run the PHP Vulnerability Checker

The utility is intended for supported Linux server environments with Bash 4 or newer.

You will need SSH access and root or sudo privileges.

Step 1: Connect to your server through SSH

Log in using your preferred SSH client or terminal.

Step 2: Download the script

curl -fL --proto '=https' --tlsv1.2 \
  -o webcare360-php-security.sh \
  https://my.webcare360.com/tools/php-patch.sh

Step 3: Review the downloaded file

Before running any downloaded script with elevated privileges, inspect its contents and confirm that it came from the expected source.

less webcare360-php-security.sh

You can also check the Bash syntax:

bash -n webcare360-php-security.sh

A successful syntax check produces no output. It does not establish that the script is safe or that its security checks are accurate.

Step 4: Run a PHP vulnerability audit

For the initial check, we recommend audit mode:

sudo bash webcare360-php-security.sh --audit

This mode examines the supported PHP inventory and generates local reports without initiating package updates.

Root privileges are required for the tool's full inventory and report generation. Audit mode still creates local report files but does not initiate PHP package changes.

Step 5: Review the results

Detected components can receive one of the following results:

An UNVERIFIED result does not necessarily mean the installation is vulnerable. It means further investigation is required.

Likewise, a PATCHED result applies to the component and evidence evaluated by the checker. It is not a guarantee that every PHP instance on the server is protected.

Can the tool also install PHP security patches?

Yes. The WebCare360 utility includes an optional interactive update workflow for supported package-managed environments.

To enter interactive mode, run:

sudo bash webcare360-php-security.sh

If the audit identifies conditions that require attention, the utility can offer to apply available PHP package updates.

Updates are not applied automatically simply because you run the script.

The interactive workflow requires administrator confirmation and asks you to confirm that verified backups and an approved maintenance window are available.

The script uses supported package management workflows where applicable and can offer the official cPanel updater separately.

Package updates may change dependencies, restart services or require PHP workers to be reloaded. On production servers, review the proposed transaction before proceeding.

If your server uses a vendor-managed PHP stack, custom builds, containers or another hosting control panel, follow that vendor's documented patch procedure.

For critical production workloads, arrange a maintenance window and maintain a tested recovery plan before applying changes.

Where are the security reports saved?

The checker stores local reports under a hostname-specific directory.

For example:

/var/log/<server-hostname>/<UTC-timestamp>-<PID>/

The generated files include:

These reports can help administrators document the packages evaluated, identify unresolved findings and plan additional verification.

Reports may reveal details about installed software and server configuration. Keep them accessible only to authorized administrators.

Why checking after a PHP update matters

Installing an updated PHP package is not always the final step.

An application may continue using an older PHP worker process until that worker has been restarted or replaced through the appropriate service-management procedure.

Multi-PHP hosting systems may also retain outdated versions assigned to individual websites.

After applying security patches:

1. Confirm that the installed PHP packages meet the appropriate upstream or vendor fixed-build requirements.

2. Verify that the correct PHP runtime is assigned to each affected website.

3. Follow the vendor's guidance for restarting or reloading affected PHP services.

4. Re-run the vulnerability audit and investigate outstanding warnings.

5. Test important application functionality, including logins, database operations, scheduled tasks and checkout workflows.

6. Review server and application logs for suspicious activity that may have occurred before patching.

A successful package installation does not prove that a server was never compromised before the update.

If exploitation is suspected, preserve relevant evidence and follow an incident response process rather than treating the patch as sufficient cleanup.

What website owners should do if they use shared hosting

If you manage a website through a shared hosting account, you may not have root-level access to inspect or update PHP packages.

In this case, contact your hosting provider and request confirmation that the affected PHP runtime has been patched.

Ask which PHP version or vendor-maintained build is being used, whether both CVEs are addressed and whether any required PHP service changes have been completed.

You should also check your application's PHP compatibility requirements before changing its assigned PHP branch.

For website owners who prefer infrastructure maintenance handled by their provider, fully managed server hosting may be an option worth evaluating.

Building a stronger long-term PHP security strategy

Emergency vulnerability patches are important, but maintaining a secure hosting environment requires an ongoing process.

A practical security strategy includes keeping the operating system and PHP runtime supported, installing verified security updates, maintaining reliable backups and limiting unnecessary privileges.

Where possible, separate applications and hosting accounts so that a compromise in one environment does not automatically expose unrelated workloads.

Review security announcements from PHP, your Linux distribution and your hosting control panel vendor.

If you operate your own infrastructure, choose a hosting environment that supports your preferred update and maintenance model.

Explore WebCare360's dedicated server hosting, offshore VPS hosting and web hosting solutions to understand the infrastructure and management options available.

Remember that having control over your server also means taking responsibility for the software you install and maintain.

Frequently asked questions

Are CVE-2026-109618 and CVE-2026-109619 critical?

Yes. Both vulnerabilities have been assigned a CVSS 4.0 score of 9.2 (Critical). Successful exploitation may allow unauthenticated remote code execution.

Is my WordPress website affected?

A WordPress installation using an affected PHP runtime may be exposed to these vulnerabilities. Updating WordPress itself does not replace the need to patch the underlying PHP installation.

Does a Web Application Firewall protect against these PHP vulnerabilities?

A WAF may provide additional protection against certain attack patterns, but it should not be treated as a complete substitute for updating PHP. Apply the vendor-approved security fixes.

Can an older PHP version still be protected?

Some vendors maintain older PHP branches with backported security patches. Protection must be confirmed against the specific vendor's fixed package builds and supported maintenance policy.

Is the WebCare360 PHP Vulnerability Checker free?

Yes. WebCare360 provides the Bash-based utility free of charge for server administrators who want to inspect supported PHP package installations and review available patch evidence.

Does the checker automatically change my server?

The --audit option does not initiate package updates. The default interactive mode can offer package updates, but requires explicit administrator approval and a backup and maintenance-window confirmation.

Does a PATCHED result mean my entire server is secure?

No. It indicates that the evaluated component meets the tool's recognized patch criteria. Other software vulnerabilities, unrecognized PHP installations, compromised applications and operational security issues may still exist.

Final thoughts

CVE-2026-109618 and CVE-2026-109619 are a reminder that website security depends on more than keeping application code and plugins updated.

The PHP runtime itself is a critical part of your hosting infrastructure, and vulnerabilities at this level deserve immediate attention.

If you manage a Linux server, begin by reviewing the current vendor advisories, identifying all installed PHP versions and applying the appropriate security updates.

After patching, verify the installed builds and active runtime rather than assuming that the update completed successfully.

Download the WebCare360 PHP Vulnerability Checker & Patch Tool to help audit supported PHP installations and identify components requiring further investigation.

Keep your server updated. Verify your patches. Protect your applications.

Security advisory reviewed October 22, 2026. This information reflects available vendor guidance as of that date. Always consult the latest official PHP, operating system and hosting control panel advisories before making production changes.