On October 21, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. These are emergency releases that fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They allow an unauthorized person to execute their own code on a server and take control of a website without knowing a username or password.
The main danger is that both vulnerabilities can be exploited before the website's own code starts running. An attacker doesn't need a vulnerable plugin, a weak password or a developer's mistake. It's enough for the server to be running a vulnerable version of PHP.
Both vulnerabilities received a severity score of 9.2 out of 10 on the CVSS scale. The PHP team explicitly states that there is no reliable protection other than updating.
What happened
Things didn't go as planned at first. On October 20, a user named petecooper posted on Hacker News that two critical PHP vulnerabilities would be disclosed on October 22 and revealed their identifiers. The post was deleted, but the information had already spread.
That same day, the PHP team warned administrators that emergency updates would be released the following day. Researchers from watchTowr said they had managed to reproduce one of the vulnerabilities. The patches were ultimately released on October 21, even slightly earlier than promised.
Here are the details:
-
CVE-2026-109618 is related to how PHP handles memory exhaustion during a request. This can lead to memory corruption and allow an attacker to execute their own code.
-
CVE-2026-109619 occurs because leftover data from a previous request remains after memory has been freed. The next request can use this data, once again opening the door to code execution.
Who is affected
All versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are vulnerable, and according to researchers, the flaws date back to PHP 5. All popular ways of running PHP on a server are affected: PHP-FPM, Apache with mod_php, LiteSpeed and others.
The scale is significant: according to W3Techs, PHP is used by approximately 71% of websites with a known server-side programming language. It powers WordPress and most CMS platforms, as well as self-hosted trackers such as Keitaro and Binom.
Website visitors don't need to do anything, as the problem is on the server side. The server will only be protected after installing a patched version.
There will be no official updates for PHP 8.1 and older versions because support for them has ended. However, due to the severity of the situation, the PHP team has released minimal patches for versions 7.4, 8.0 and 8.1. These will have to be applied manually by compiling PHP from source code.
What to do
-
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP-FPM or the web server. Otherwise, the old code will continue running.
-
Verify that the update was actually installed. If PHP was installed from Ubuntu or another Linux distribution's packages, the PHP version number may remain unchanged. For example, on a patched Ubuntu 24.04 system, PHP may still report version 8.3.6, while only the package version changes.
-
If you can't update right now, disable the session.upload_progress.enabled setting and restart PHP. This blocks one of the confirmed attack methods but does not provide complete protection against the vulnerabilities.
-
Check the logs for suspicious activity starting from October 20.
What this means for affiliate marketers
If your tracker, pre-landing pages or White Pages are hosted on your own server, you should check them first. Taking control of a server running a tracker means gaining access to statistics, offers and traffic flow settings, as well as the ability to secretly replace links.
If you use a cloud-based tracker or hosting with automatic updates, the provider is responsible for updating PHP. However, it's still worth checking with support to confirm whether the patch has been installed.
No reliable public exploits have been observed yet. But since the details leaked even before the patch was released, you shouldn't delay updating.
