Every branch
| Branch | Fixed in | Status | Support ends |
|---|---|---|---|
| PHP 8.5 | 8.5.12 | Patched release | 31 December 2029 |
| PHP 8.4 | 8.4.27 | Patched release | 31 December 2028 |
| PHP 8.3 | 8.3.36 | Patched release | 31 December 2027 |
| PHP 8.2 | 8.2.35 | Patched release | 31 December 2026 |
| PHP 8.1 | – | Source backport only | 31 December 2025 |
| PHP 8.0 | – | Source backport only | 26 November 2023 |
| PHP 7.4 | – | Source backport only | 28 November 2022 |
| PHP 7.3 and older | – | No official fix | Long ended |
For 8.1, 8.0 and 7.4 the PHP project published minimal source branches in the php-src repository (PHP-8.1-CVE-2026-109618-109619, named the same way for 8.0 and 7.4). They have no tagged releases and no binaries. Distributions and long-term support vendors got the patches in advance; see old PHP versions.
Where the fix reaches servers
Linux distributions and package repositories rebuild PHP themselves, on their own schedule. Here is the status each source publishes:
| Source | Status |
|---|---|
| Ubuntu | Fixed packages |
| Debian | 2 of 4 fixed |
| Red Hat Enterprise Linux | 1 of 6 fixed |
| AlmaLinux | No fix yet |
| Rocky Linux | No fix yet |
| Fedora | 2 of 4 fixed |
| SUSE / openSUSE | No fix yet |
| Alpine Linux | No fix yet |
| Amazon Linux | No fix yet |
| Docker official php image | 4 of 6 fixed |
| Ondrej Sury PPA / deb.sury.org | 2 of 3 fixed |
| Remi's RPM repository | 6 of 8 fixed |
| windows.php.net | 2 of 3 fixed |
| Homebrew | 4 of 5 fixed |
Hosting companies
We read the public pages of 26 hosts. 21 had said something and 5 had not. All hosts, with sources.
- You must act1
- GoDaddy
- Rolling out12
- IONOS, Pantheon, Cloudways, SiteGround, OVHcloud, Bluehost, HostGator, Namecheap, DreamHost, InMotion Hosting, Liquid Web, A2 Hosting (hosting.com)
- Checking1
- Nexcess (Liquid Web)
The two vulnerabilities
CVE-2026-109618 · CVSS v4.0 9.2
Memory corruption after out-of-memory, leading to remote code execution.
CVE-2026-109619 · CVSS v4.0 9.2
Stale global state, leading to remote code execution.
How PHP runs decides the risk
| Runs as | What the advisories say |
|---|---|
| Apache mod_php | Highest risk. An unauthenticated request can trigger it before any application code runs, and the advisory mentions a working demonstration. |
| PHP-FPM | Exploitable according to source analysis. The PHP project has not published a complete exploit. |
| LiteSpeed / LSAPI | Listed as affected. Same assessment as FPM. |
| php-cgi | Listed as affected. |
| FrankenPHP | Listed as affected. |
| CLI | The command line does not face the web. If the CLI binary is an affected version, though, the web SAPI usually is too. |
The PHP advisories do not report exploitation in the wild, and neither CISA nor BSI had confirmed any when we checked. Security vendors including Cloudflare, watchTowr and Patchstack report attack attempts. Treat any unpatched server as exposed.
Open questions
- Regressions in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: none reported in php-src issues by 17:30 UTC on 21 Oct, but the releases were less than a day old.
- Exploitation: Cloudflare, watchTowr and Patchstack report attack attempts; CISA, BSI and CERT-EU had not confirmed exploitation in the wild. No official indicators of compromise have been published.
- CISA Known Exploited Vulnerabilities catalog: neither CVE was listed at 17:36 UTC on 21 Oct. We recheck before each update.
- Extended support: HeroDevs names both CVEs for PHP 7.4, 8.0 and 8.1. Zend's fix for its LTS builds is reported second-hand only, and we found nothing from TuxCare.
- Red Hat: RHEL 7 data lists one CVE as affected and the other as not affected; RHEL 6 is out of scope. We are waiting for a clear statement.
- Alpine: the security database lists fixed php84 and php85 packages, but the x86_64 package index still served 8.4.26 at 17:30 UTC.
- The GitHub Advisory Database had not yet published reviewed entries for either CVE, so Dependabot and similar tools may not flag them yet.