On 21 October 2026, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow an unauthenticated attacker to remotely execute arbitrary PHP code on a web server.
All PHP versions from 5.4 onwards are affected, including end-of-life branches (8.1 and older), which will not receive a fix.
Official announcement: https://www.php.net/archive/2026.php#2026-10-21-5
What you need to do
Update PHP to the latest version on all your servers. If you use a control panel, follow the instructions for your panel.
Plesk
Plesk instructions: https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk
KeyHelp
KeyHelp community thread: https://community.keyhelp.de/viewtopic.php?t=14644
Update the additional PHP interpreters manually:
keyhelp run php-updateThe system PHP is updated separately:
keyhelp run package-updateDocker
The official PHP Docker images have already been updated. Pull the latest image for your branch and recreate your containers, for example:
docker compose pull
docker compose up -dIf you build your own images on top of php:*, rebuild them with --pull so the updated base image is used.
Servers without a control panel
Install package updates using your distribution’s package manager (for example, apt update && apt upgrade on Debian/Ubuntu or dnf update on AlmaLinux/Rocky) and restart PHP-FPM or your web server. If PHP was built from source or installed from a third-party repository, update it from the same source.
After updating
Check the version with php -v. If you are running an end-of-life PHP branch (8.1 or older), you must migrate to a supported version — no fixes will be released for old branches.
If you have any questions or need help with the update, please contact our support team.
