A PHP update suited to your environment
When time matters, you need to know who can install the update and what will be checked. We start with the PHP version handling your website, its extensions and the server operator. The command-line version can differ from the version serving web requests. With managed hosting, we coordinate with you and the provider to establish the available fix and who is authorised to install it.
The work we agree with you
First we establish the scope, access, possible interruption and recovery plan. We agree the work and checks before making changes.
- Inventory: identify the PHP runtime, hosting, application, extensions and responsible administrator or provider.
- Prepare recovery: check the relevant backup and recovery plan before updating.
- Apply the appropriate patch: choose the corrected release in your PHP branch or a vendor package with a confirmed backport, checking compatibility and the package source.
- Verify the active runtime: restart the required services or workers and establish that web traffic uses the updated runtime.
- Run agreed functional checks: for example login, forms, checkout and integrations; report the checks performed and any remaining issues.
Why act now?
On 21 October 2026, PHP announced two critical vulnerabilities that may permit remote code execution without authentication. Fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The announcement covers installations serving web requests and urges immediate updates. We check which fix your environment needs with its administrator or provider.
Updating WordPress alone does not update PHP
WordPress, plugins and the PHP runtime each have their own updates. An updated plugin does not establish that the server uses the PHP fix. A vendor may backport the security fixes into its own package version: ask for confirmation that both advisories are covered. Temporary configuration measures do not replace the patch.
Suspect something has already happened?
Mention suspicious logins, changed files or other signs in your first message. Installing a patch does not establish that an environment is free of earlier compromise. Incident investigation is a separate engagement, with agreed evidence handling, scope and next steps.
What can you send now?
Send the domain, provider, what you know about the PHP version and the functions that need to keep working. Tell us whether you or another administrator manages the server. We will agree availability, the work and checks with you. Email info@oxiae.com directly with PHP-spoed in the subject line. Available today and throughout the night: 21 October and overnight into 22 October 2026.
CVE-2026-109618 — RCE via OOM corruption
An error during out-of-memory handling can leave internal request data incompletely initialised. Cleanup may then use invalid data. Remote code execution was demonstrated with Apache mod_php, before application code runs. See the official advisory.
CVE-2026-109619 — RCE via stale global state
A PHP worker may retain references to memory freed after an earlier request. A subsequent request can then use that stale state: a use-after-free. Session lifecycle RCE was validated with mod_php and FPM; the FPM path depends on a suitable application operation.
PHP-FPM is therefore not automatically unaffected. Exposure differs by bug, application, extensions and configuration. Ask your host to confirm the fix for both CVEs.
Which PHP versions need updating?
| PHP branch | Affected | Patched |
|---|---|---|
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.5 | < 8.5.12 | 8.5.12 |
These thresholds apply within each listed upstream branch. Vendor packages may use a different version number with confirmed backports. PHP 8.1 and older no longer receive PHP-project updates: verify vendor support and both fixes, or plan an upgrade to a supported branch.
Questions about urgent PHP updates
Does this affect WordPress?
WordPress runs on PHP. Ask your host which PHP runtime serves your website and whether both fixes are active. Updating WordPress or plugins alone does not establish this.
Can my host already have patched an older package version?
Yes, a vendor can backport fixes. Ask for the package identifier and confirmation that both CVEs are covered; the PHP version number alone is not enough.
What do I send to request urgent help?
Email your domain, hosting provider, known PHP version and a short description. Put PHP-spoed in the subject line. Do not email passwords; we will arrange access separately.