Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619
Update:
All widely used PHP versions at Lightning Base have been patched against these vulnerabilities. We are waiting on rollout for a handful of less-used or older PHP versions, with all versions from 5.2-8.5 receiving updates. The one caveat is the versions shown in PHP info do not necessarily reflect the patch.
CloudLinux (our operating system vendor) pushed out updated versions for all ea-php releases 5.2-8.5, and is continuing to release for alt-php (which will be backported all the way down to 5.2 for those that require very old releases). The updates read as something like ‘ea-php83: 8.3.35-2.elX.cloudlinux.2’, rather than ‘ea-php83: 8.3.36.elX.cloudlinux.2’ – instead of going to 8.3.36, they go to 8.3.35-2. This is standard for all the old versions receiving backported fixes (that are not fixed by the PHP team but are fixed on our systems). I’m not certain right now why they pushed the newer releases out that way as well.
That means when you look at a PHP info page they still show PHP 8.3.35. But the patches are applied, for instance, on one sample system with ea-php83:
rpm -q ea-php83-php-cli –changelog | grep -E ‘CVE-2026-(109618|109619)’
url_scanner_ex.c and ext/json/json_scanner.c for the CVE-2026-109618/109619 patch: el7/el8 re2c 0.14.3
– EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory-
That is the relevant patch, ported over from the official PHP release. I’m still waiting to hear if CloudLinux will be rolling these out eventually with more mainstream version numbers (I suspect they will because people are going to be confused), but your sites have been protected with this now for some time now in addition to our other mitigations.
Original Post:
PHP announced a pending update to address critical security vulnerabilities on October 20th. These could allow remote code execution, leading to full compromise of a site running PHP, which is the language powering all WordPress sites. These are numbered as CVE-2026-109618 and CVE-2026-109619, and both have high CVSS, indicating critical problems in PHP.
Temporary Mitigations
Several hours after the initial announcement, our security vendor released updated webapp firewall rules to help block exploit of the vulnerabilities. These types of rules are not a complete solution, but they are intended to slow down attackers and block early exploit methods that may be publicly released. They will continue to be updated as security services see attacks against these CVE’s. The webapp firewall rules were automatically applied to our systems upon release.
They were reports early on that disabling PHP’s session.upload_progress.enabled option could help prevent one of the vulnerabilities from being exploited. We applied this early, which again is not a complete solution but is intended to delay any attacker’s ability to take advantage of these vulnerabilities. When PHP released its patches, they also specified some additional mitigations, which we have partially applied as we wait for patches to go live on our systems.
PHP Updates
As this post is being written, PHP updates are beginning to be applied to our systems. These will initially be rolled out for PHP 7.4+, and we expect it to be applied back to even earlier versions later today. If your sites are hosted at Lightning Base no action is required on your end to take advantage of this, the updates will be automatically applied to all sites. Once updates have rolled out PHP will be restarted, which is in most cases seamless, at most sites may see a brief moment or two where requests slow down or don’t go through.
Conclusion
I would like to thank the PHP team, the various security researchers looking into this, and our vendors for working on this problem. Based on what we have heard and seen exploit attempts against these vulnerabilities have been very limited prior to release of full updates, and with the mitigations we employed temporarily combined with the rollout of patches I expect our client sites should not be impacted by this severe security issue.
There has been a continuous stream of serious security problems across the entire software industry in recent months leading to urgent updates. This may continue for some time, and we will continue to work on keeping sites safe going forward.
