Two critical PHP flaws let attackers run code on your server. We'll patch it for you.
The PHP project has released emergency fixes for two vulnerabilities that allow unauthenticated remote code execution - in some setups before your application code even runs. Our engineers update, harden and verify each PHP instance end to end.
Per instance, one-time. More than 5 servers? for volume pricing.
Anything below these versions is exposed.
What happened
On 21 October 2026 the PHP security team shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two critical bugs in how PHP handles memory and request state. Both are rated CVSS v4.0 9.2 and can be triggered remotely by an attacker who doesn't need to log in.
RCE via out-of-memory corruption
When PHP runs out of memory mid-request, it can stop while internal request data is only half set up. The cleanup step that follows may then trust that broken data as if it were valid - a path an attacker can steer toward running their own code.
RCE via stale global state
Some internal state that belongs to one request can outlive the memory behind it. The next request served by the same PHP worker may read that stale state before it is reset - again giving an attacker a route to code execution.
Who is at risk
Every PHP installation that serves web requests. The PHP team rates Apache with mod_php as highest risk: a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs, so your app's own security can't stop it.
| Your PHP branch | Fixed in | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | End of life 31 Dec 2026 - plan your upgrade |
| 8.1, 8.0, 7.4 | No official release | Minimal source backports published by the PHP security team; vendor/LTS packages where available |
Configuration workarounds only narrow specific attack paths - the PHP project is clear that updating is the only complete fix. Using the volunteer-run remirepo packages? They won't carry this update on release day, so switching to distribution packages or a source build is advised.
What Bobcares does to fix it
Every PHP instance goes through the same six-step runbook, carried out by our server engineers - not an automated script you have to trust blindly.
Audit & back up
Identify every PHP version, handler (mod_php, FPM, CGI, LiteSpeed, FrankenPHP), pool and package source on the server. Take a configuration backup or snapshot before touching anything.
Interim hardening
Where an update can't go in immediately, apply the PHP team's recommended mitigations at server level - memory and upload limits, session.upload_progress.enabled=0, and on 8.5 fatal_error_backtraces=0.
Patch PHP
Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from your distribution or vendor, moving you off sources that won't receive the fix. For 8.1 and older, apply the vendor LTS fix or the official security backport.
Restart every worker
Gracefully restart Apache, every PHP-FPM pool and LiteSpeed/FrankenPHP workers so no process is left running the vulnerable build.
Verify
Confirm the patched version on every handler (CLI and web), check that settings weren't overridden per site, review error logs and smoke-test your sites.
Report
You receive a written summary: before/after versions, changes made, anything that still needs attention, and upgrade advice for end-of-life branches.
One-time fee. No contract.
Contact our support team for volume discounts on fleet-wide patching.
Questions
What counts as an instance?
One server, VM or container host running PHP. Multiple PHP versions on the same server are covered by the same fee.
Can't I just change a few settings?
Settings reduce exposure to known attack paths but don't make a server safe. The PHP project states an update is the only complete fix.
I'm on PHP 8.1 or older.
There's no official release for your branch. We apply your vendor's LTS fix or the PHP security team's backport, and advise on moving to a supported version.
Will my sites go down?
PHP workers are restarted gracefully. We back up configuration first and smoke-test your sites after patching.
Don't wait for an exploit to find you.
Close CVE-2026-109618 and CVE-2026-109619 on your servers - $29.99 per instance.