On 20 October the PHP project announced a security release for the next day at 14:00 UTC (16:00 Dutch time). It fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and both usable to run code on a server without logging in. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no official release; the PHP security team published source backports only for people who build PHP themselves.
On the morning of the 21st, Cloudflare reported exploit payloads in use from 07:43 UTC, more than six hours before the release.
Making sure the patch would arrive by itself
Before the release we made sure every web server would install the new PHP packages automatically. Automatic updates now run every hour instead of once a day, and fetch the latest package index first, so a new build is picked up within the hour.
Moving sites off a server that could never be patched
Some sites still ran on an older server whose operating system no longer receives PHP updates. Whatever PHP released that afternoon would never have reached it.
That same morning we moved every site that was still in use to a current server. After each move we automatically compared the site with the original, and rolled back if anything differed. For visitors nothing changed, apart from a few problems we fixed the same day.
Unused copies and old leftovers on that server were taken offline, and services it no longer needed were switched off.
PHP 8.2 or newer, everywhere
PHP 7.4, 8.0 and 8.1 get no new official release, so we moved every site to PHP 8.2 or newer. Once no site used the old versions, we switched them off on all our web servers.
Interim protection until the patch was in
Both vulnerabilities are reached through multipart requests, the request type browsers use for file uploads and many forms. Until the new version was running:
- PHP's session upload-progress feature was switched off on every server. PHP lists this as a partial mitigation, and it covers only one of the two bugs.
- Our load balancer refused multipart requests to PHP sites, which reduced the risk for every site behind it at once. For a few hours, file uploads and some contact forms did not work. Normal pages, logins and simple forms kept working.
- Admin tools and one test application that we could not patch yet were closed to the public or switched off.
Patching
The packages appeared during the afternoon, at a different moment for each distribution. The Debian builds landed around 15:30 Dutch time, before the scheduled release, and some of our servers ran them minutes later. The RPM builds followed around 16:15. As each one became available we installed it, confirmed that every server ran the new version, and checked that the sites still worked.
Our PHP packages come from two repositories run by individual maintainers: Ondřej Surý's for Debian and Remi Collet's for Red Hat-style systems. Both had builds out on the afternoon of the release, and because of that some of our servers ran the fix before the release time. Thank you both.
By 16:30 Dutch time, half an hour after the scheduled release, all our web servers ran the patched PHP versions. The multipart block came off, and uploads and forms worked again.
A few container-based applications are waiting for updated images from their vendors. Until those arrive, they stay behind the interim protection.
For site owners
- Keep your CMS, plugins and themes up to date. Plugins that are no longer maintained are the usual reason a site can't move to a newer PHP version.
- Plan for PHP 8.3 or newer. PHP 8.2 receives security fixes only until 31 December 2026.
- If something on your site behaves differently since 21 October, let us know at support@coffeesprout.com or 085 004 3957.
Sources
- PHP: advance notice of 20 October and the release and security advisory
- CERT-EU security advisory 2026-018
- Sansec: research write-up
- Mattias Geniar: web server rules for blocking multipart requests
- PHP support and end-of-life dates
Running PHP sites for your clients? Read about our website hosting for agencies, or talk to us.