Priority security notice | Official patches released: 21 October 2026 | Article prepared: 22 October 2026.
What happened?
PHP disclosed CVE-2026-109618 and CVE-2026-109619, involving out-of-memory handling and stale global state. Under certain conditions, unauthenticated attackers can execute code on a server. All web-facing PHP environments should be assessed, including WordPress, app APIs and other PHP systems.
Upgrading to “PHP 8.3” alone is not enough
The official patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Install the patched release for your supported branch or a later update. Where your hosting provider uses backported fixes, request confirmation of the package and patch status rather than checking only the major version. For PHP 8.1 or older, confirm patching and migration arrangements with the provider.
What should website owners do now?
1. Inventory production sites, staging sites, app APIs, scheduled tasks and PHP environments, then confirm full versions and patch status with the hosting provider. 2. Preserve database and file backups and suspicious access logs, arrange urgent patching, and have the administrator restart affected workers and confirm no old processes remain. 3. Verify critical functions such as login, forms, payments and app endpoints, and continue checking for unusual accounts, files and activity.
Can a firewall replace an update?
No. PHP states that temporary mitigations do not provide a complete solution. If an immediate update is not possible, the hosting provider or security team should assess temporary exposure restrictions. Suspected compromise also requires incident investigation: patching PHP does not remove an existing intrusion.
This is general incident response guidance, not confirmation that ATOM has patched your existing website or app. This work updates demo website content only; it does not change the hosting PHP configuration.
Source:PHP official security advisory (21 October 2026). Prepared by ATOM as an editorial summary and application perspective. Refer to official announcements for changes to availability, terms and supported regions.