Security advisory: critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

On 21 October 2026 the PHP project published an emergency release for two critical vulnerabilities in PHP core: CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2 each). Both allow remote code execution without authentication: an attacker who can send an HTTP request to any PHP script can run code as the PHP process. The official PHP advisory is titled "update now". Details leaked before the coordinated disclosure, and early attacks are already being reported. Hosting providers are rolling out the fix to their managed platforms right now. Hetzner, for example, is updating its managed hosting products. On your own VPS, patching is your job.

Who is affected

Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project rates mod_php as the highest risk. The flaws sit in request parsing, before your application code runs, so login screens, security plugins and middleware do not protect you.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while request data is only partly initialised, and the cleanup then treats invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request state can survive after its memory was freed, and a later request on the same worker can use it. Upload progress tracking and fatal error backtraces reach it.

ShadowPanel servers are affected through PHP, not through ShadowPanel itself. The panel's API and daemon are Node.js. But every hosted PHP site runs on the server's PHP-FPM, and so do phpMyAdmin and webmail on the admin port. The fix comes from your distribution's PHP packages. No ShadowPanel update is required to receive it.

The fixed versions

Note that PHP 8.2 itself reaches end of life on 31 December 2026.

Step 1: check what your server runs

ShadowPanel installs PHP from the ondrej/php repository and can run several versions side by side. Check each one:

for v in /etc/php/*/; do v=$(basename "$v"); echo "$v: $(php$v -v 2>/dev/null | head -1)"; done

Any version below the table above is vulnerable.

Step 2: install the patched packages

apt update
apt list --upgradable 2>/dev/null | grep '^php'
apt upgrade
systemctl restart 'php*-fpm'

Use restart, not reload, so that no worker keeps running the old binary. Then run the check from step 1 again and confirm the new version numbers.

Distribution packages can arrive a few hours after the upstream release. If apt list --upgradable does not yet show the fixed version, apply step 3 now and repeat step 2 later today.

Step 3: reduce the risk until the packages arrive

PHP core developers are clear that only patching fixes these flaws. The measures below reduce the risk. They do not remove it.

Turn off session upload progress. This closes the confirmed exploitation path for CVE-2026-109619 and costs nothing on most sites:

for d in /etc/php/*/fpm/conf.d; do
  echo 'session.upload_progress.enabled = 0' > "$d/99-upload-progress-off.ini"
done
systemctl restart 'php*-fpm'

The file in conf.d applies to every pool of that PHP version, including the per-site pools ShadowPanel creates. You can leave it in place after patching. On PHP 8.5, also add fatal_error_backtraces = 0 to the same file.

Limit request sizes for CVE-2026-109618. The PHP advisory recommends memory_limit = -1 together with post_max_size = 8M and upload_max_filesize = 8M (32M if the site needs uploads). Removing the memory limit is only safe when something else stops a runaway worker, such as a MemoryMax= limit on the PHP-FPM systemd service. Do not use RLIMIT_AS or RLIMIT_DATA for this.

Remove noise from your PHP configuration. Deprecated or invalid settings that print warnings on each request, and fatal errors or timeouts an attacker can trigger, all help the exploit. Hiding them with error_reporting, display_errors or @ does not help.

Block multipart requests on sites that do not need uploads. A brochure site or a blog without public forms can refuse multipart/form-data at nginx, before PHP sees the request. Do not do this on a shop, a forum or a WordPress admin that uploads media: it blocks every file upload.

A web application firewall rule from a CDN or ModSecurity can stop known exploit requests, but new variants appear quickly. Treat it as a stopgap only. Settings changed with ini_set() or .user.ini do not protect you: put them in the PHP-FPM configuration and restart.

Step 4: move sites off end-of-life PHP

PHP 7.4, 8.0 and 8.1 get no new release. The PHP project published minimal source backports for them, but whether your package repository builds them is up to its maintainer. If a site still runs on one of them, this is the moment to move it, preferably to PHP 8.3 or newer, because 8.2 support ends this year. In ShadowPanel, the PHP version is set per site, so you can move one site at a time and keep the others untouched. Test the site on the new version first, ideally on a staging copy. If you want to understand how per-site versions work, see running multiple PHP versions per site.

Step 5: look for signs of compromise

The flaws were public before the patch. If your sites were reachable in the meantime, check:

• unknown PHP files in upload and cache directories, and recently modified files in your web roots;
• PHP-FPM errors in /var/log/php/ and unusual POST requests in the nginx access logs;
• new admin users, cron jobs or SSH keys you did not create.

ShadowPanel's malware scanner (Pro and Agency) can scan a full site with ClamAV.

Summary

1. Check every installed PHP version.
2. Install the patched packages and restart PHP-FPM.
3. Until then, turn off session.upload_progress, limit request sizes and restrict uploads where you can.
4. Move sites still on PHP 7.4, 8.0 or 8.1 to 8.3 or newer.
5. Check your sites for signs of compromise.

For the official details, read the PHP security advisory on php.net. If you run ShadowPanel and have questions about your server, open a support ticket from your account.