PHP Critical RCE Vulnerabilities: A Linux Admin’s Patch and Verification Checklist

How to find every web-facing PHP runtime, apply the right vendor fix, and confirm the update actually loaded.

Updated October 23, 2026

On October 21, the PHP project published a security advisory for two critical vulnerabilities that could allow unauthenticated remote code execution: CVE-2026–109618 and CVE-2026–109619. The advisory covers PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP says the demonstrated risk is highest for mod_php, but the practical response starts the same way for every environment: find the PHP runtimes you operate and determine how they are patched.

The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux distributions and long-term support vendors may provide fixes as backported packages, so check the security notice for your operating system or hosting provider. The upstream version string alone may not tell you whether a vendor package contains the fix.

1. Find every PHP runtime

Start with your asset inventory, then confirm it against the systems that are actually running. Include:

• Web servers using PHP-FPM, Apache mod_php, CGI, or another PHP…