PHP 8.1 and older got no fix for today's critical PHP RCEs. What to do.

On 21 October 2026 the PHP project released 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Each one fixes two critical bugs that can give an unauthenticated attacker remote code execution:

CVE-2026-109618, RCE via out-of-memory corruption
CVE-2026-109619, RCE via stale global state left over from an earlier request

The advisory says every PHP install serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team rates mod_php as the highest risk. They have a working exploit there that fires before any application code runs.

If you are on 8.2 or newer, install the update and you are done. Below 8.2 it gets harder.

Where your version stands

PHP 8.5: fixed in 8.5.12. Security support until 31 Dec 2029.
PHP 8.4: fixed in 8.4.27. Security support until 31 Dec 2028.
PHP 8.3: fixed in 8.3.36. Security support until 31 Dec 2027.
PHP 8.2: fixed in 8.2.35. Security support until 31 Dec 2026.
PHP 8.1, 8.0, and 7.4: no release, only minimal source patches you build yourself. Security support has ended.
PHP 7.3 and older, and 5.x: nothing from the PHP project. Security support has ended.

Run php -v on every server and every container image that serves web traffic. The base image in a Dockerfile counts.

On 8.2 to 8.5

Update today. Linux distributions and LTS vendors got the patches in advance, so check your package manager first.

If you install PHP from rpms.remirepo.net, the PHP project says that repo will not have updates today. They recommend switching to your distribution's packages or building from source.

8.2 is patched, but its security support ends 31 December 2026. Plan the move to 8.4 or 8.5 now.

On 8.1 or older

You have three options, and only the last one gets you security fixes for the next bug.

Ask your distribution or LTS vendor for a backport. Some of them ship fixes for old branches.
Build from source with the PHP security team's minimal patches. They exist for 7.4, 8.0, and 8.1 only. There is nothing for 7.3 or older.
Upgrade to 8.4 or 8.5. 8.5 gets security fixes until the end of 2029.

Settings that reduce exposure in the meantime

The advisory lists interim measures, and says they do not make an install safe. Updating is the only full fix. The main ones:

For CVE-2026-109618, set memory_limit=-1 where applications cannot override it, such as php_admin_value in the FPM pool or Apache config. Lower post_max_size: 8M if you take no uploads, 32M if you do. Keep upload_max_filesize below it.
For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart every worker. ini_set() and .user.ini do not work for this. On 8.5, also set fatal_error_backtraces=0.

Read the full advisory before you change production. It covers proxy-level request limits and cgroup settings too, along with settings it tells you not to use.

What breaks when you upgrade from old PHP

PHP 7.0 removed the mysql_* functions and ereg. PHP 7.2 took mcrypt out of core, so any data encrypted with it needs a migration plan.

PHP 8.0 removed each() and create_function(). It also changed how strings compare to numbers, so some conditions now go the other way without raising an error.

PHP 8.1 deprecated passing null to built-in functions that expect a value, and 8.2 deprecated dynamic properties.

Then there is the framework or CMS. An old Laravel, Symfony, or CodeIgniter release, or a WordPress plugin nobody maintains, may not run on the new PHP at all. In that case it moves in the same plan.

PHPCompatibility (a PHP_CodeSniffer standard) and Rector dry runs will list most of this before you change a line.

If you want help

We upgrade PHP from 5.x onward, on Laravel, WordPress, Symfony, CodeIgniter, or no framework. It starts with a free 30-minute call. Within 48 hours you get written findings: what runs where, what blocks the target version, and the order of work. PHP upgrades.