Critical PHP flaws CVE-2026-109618 and CVE-2026-109619: why sites went offline and how to patch yours

On 21 October 2026 the PHP project released fixes for two critical flaws that can let anyone on the internet take control of a website, without logging in. Within hours, government websites in Europe and Canada were taken offline until they were patched. If your website runs on PHP, and every WordPress site does, here is what happened, why, and how to fix it today.

What happened

• 20 October: the PHP team announced an urgent security release for two critical vulnerabilities, both rated 9.2 out of 10, and asked everyone to prepare to update.
• 21 October, around 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. The flaws are CVE-2026-109618 (“RCE via OOM corruption”) and CVE-2026-109619 (“RCE via stale global state”).
• The same day: agencies in the Netherlands and Finland took government sites offline as a precaution, Canadian provincial sites went down, and cybersecurity agencies in Europe, the UK, Australia and Japan told site owners to update immediately or go offline until they could.

Why it is so serious

Most website security problems need something to go wrong first: a weak password, an outdated plugin, a careless admin. These two do not. According to PHP’s own advisory, a single crafted request can trigger the attack before any of your website’s code runs, and it needs no account and no login.

If it works, the attacker can run their own code on your server, with the same access your website has. That means they can:

• read your database password and the data behind it, such as customer details and orders;
• change your pages, add spam or redirect your visitors;
• leave a hidden back door to come back later, even after you update.

It affects anything built on PHP: WordPress and WooCommerce, Drupal, Joomla, Magento, Laravel apps and custom PHP sites, on shared hosting, VPS or cloud servers alike.

Why this is happening

Both flaws are in PHP itself, the engine that runs your website, not in WordPress or your own code. In plain English:

• CVE-2026-109618, “OOM corruption”. When a request runs out of memory, PHP abandons it in a hurry. At that moment some memory has not been fully set up, and PHP’s clean-up step reads it anyway. An attacker can push a request into exactly that state with a specially built form upload.
• CVE-2026-109619, “stale global state”. A PHP worker handles many requests one after another. Some information left over from one request can still point at memory that has already been freed, and the next request can use it. A carefully prepared pair of requests turns that into running the attacker’s code.

The flaws were reportedly found with the help of AI tools. That also explains the urgency: now that the fix is public, attackers can compare the old and new code and work out the attack quickly. The PHP team says there is no complete workaround, and updating is the only safe choice.

Are you affected?

If your website runs on PHP and the PHP has not been updated since 21 October 2026, assume yes.

How to fix it

1. 1Find your PHP version. In cPanel, open “Select PHP Version” or “MultiPHP Manager”; in Plesk, “PHP Settings”. In WordPress, go to Tools → Site Health → Info → Server. On your own server, run php -v.
2. 2Update PHP. On shared or managed hosting, your host patches the server: ask them today whether PHP is patched for CVE-2026-109618 and CVE-2026-109619. On your own server, install your provider’s updates (commands below).
3. 3Restart PHP. The old version keeps running until PHP-FPM or Apache restarts, along with any long-running PHP workers such as queues.
4. 4Confirm it worked. Check the version again, or your provider’s package changelog for the two CVE numbers. Then check the site for changes you did not make (next sections).

On Ubuntu or Debian:

sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm     # use your version, e.g. php8.4-fpm
sudo systemctl restart apache2        # if you use Apache with mod_php
zcat /usr/share/doc/php8.3-cli/changelog.Debian.gz | grep -m2 CVE-2026-10961

On AlmaLinux, Rocky Linux or Red Hat:

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

With Docker, pull the latest official PHP image for your version and rebuild and redeploy every container. On a Mac with Homebrew, run brew upgrade php.

If you cannot update today

The official advisories list some temporary measures. They reduce the risk but do not remove it, so treat them as a bridge to the update, not a replacement:

• Take the site offline or into maintenance mode if it handles customer data, as many governments did.
• Set session.upload_progress.enabled = 0 and restart PHP. This blocks a demonstrated attack path, and the advisory suggests keeping it off if you do not use it.
• On PHP 8.5, set fatal_error_backtraces = 0 and restart PHP.
• If your site has no forms with file uploads, block multipart form requests at your web server, CDN or firewall.
• Keep upload and form size limits (post_max_size, upload_max_filesize) as small as your site allows.

Check you were not hacked

If your site ran unpatched PHP after 21 October, look for signs that someone got in:

• Files you did not change, especially new .php files in upload folders such as wp-content/uploads.
• New admin users in WordPress or your CMS.
• New scheduled jobs (cron) or programs you do not recognise.
• PHP crashes or 500 errors in your server logs around and after 21 October.

find /var/www -type f -name "*.php" -newermt "2026-10-21"
crontab -l; sudo ls -la /etc/cron.d

If you find anything suspicious, take the site offline, restore it from a backup made before 21 October, update PHP, and then change every password and key the site uses: database, admin accounts, and API keys in files such as .env or wp-config.php.

How we handled it on 99ai.io

Our own website runs on PHP. Our server installs security updates automatically, and the patched PHP for both flaws was installed and running the next morning. We then checked the server for signs of tampering: changed files, hidden scripts, errors and crashes, new scheduled jobs, new accounts and logins. We found none.

Can’t do it yourself? We’ll patch it for you

Frequently asked questions

Sources

• PHP.net: security advisory and the 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases (21 October 2026)
• GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
• GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
• CNBC: Government websites go dark as software flaw sparks security scramble
• CBC: Canadian government sites among those offline