PHP · Web Security

PHP Security Update: October 2026 Fixes and Upgrade Steps

Find the patched PHP versions for CVE-2026-109618 and CVE-2026-109619, update the runtime serving your site, and verify the fix.

By Bipin Paudel · October 23, 2026 · 5 min read

Keeping PHP updated is an essential part of maintaining a secure website. On October 21, 2026, the PHP team published fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The issues can allow unauthenticated remote code execution on affected PHP installations that serve web requests.

If you manage a PHP or Laravel website, identify the runtime serving requests, apply your vendor's patched package or the corresponding PHP release, and verify the change. The PHP team says updating is the complete fix; temporary configuration measures only reduce exposure.

1. Check your current PHP version

On a server with terminal access, run:

php -v

This reports the command-line PHP version. Your website may use a different runtime through PHP-FPM, Apache with mod_php, CGI, or your hosting control panel, so check the web-facing runtime too.

2. Install the fixed PHP security release

The PHP project lists these fixed releases for the October 21 advisory:

PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

These are the PHP project's release numbers. Linux distributions and long-term support vendors may publish the fix in packages with different version strings, so check your vendor's security notice. PHP 8.2 reaches end of life on December 31, 2026; plan a move to a branch that will continue receiving security updates.

For cPanel: Open MultiPHP Manager or your host's PHP selector and check the version assigned to your domain. If the fixed package is not available, ask your provider to update it.

For VPS or dedicated servers: Use your operating system's trusted package repository or managed PHP distribution. Package names and commands vary by operating system. Restart or reload PHP-FPM and the web server as your setup requires.

3. Verify the PHP version serving your website

Do not rely on php -v alone. Confirm the domain's assigned version in your hosting panel or inspect the PHP-FPM pool and web server configuration. For a Laravel application, a temporary authenticated diagnostic route can report the runtime version; remove it as soon as you finish. Avoid leaving a public phpinfo() page online because it exposes server configuration details.

4. Test your application after the PHP update

Check login, forms, file uploads, scheduled jobs, queues, payment integrations, and features that depend on PHP extensions. For Laravel projects, confirm platform requirements with:

composer check-platform-reqs

Review application and PHP logs after deployment, and keep Laravel and Composer dependencies updated as part of ongoing maintenance.

Final thoughts

Updating PHP closes the specific runtime vulnerabilities addressed by the release. It does not make an application completely secure, but it is a necessary step for reducing exposure to known issues. Check the official advisory for current guidance and vendor-specific package details.

Stay updated. Stay patched. Stay secure.