PHP’s October 2026 Security Updates: A Small-Team Action Plan

PHP’s October 21 security announcement calls for immediate updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The upstream releases containing those fixes are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your SaaS serves requests through PHP, prioritize the runtime update even when your application code has not changed.

The October 23 follow-up addresses a separate, unlikely session upload progress RCE vector, CVE-2026-115560. PHP recommends disabling that feature until the next regular bugfix release. The October 21 versions should not be described as resolving this residual issue.

For a small team, keep two entries in the change record: installation of the October 21 fixes, and evaluation of the October 23 session guidance. Closing the first entry does not automatically close the second.

PHP’s October 21 announcement includes all installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. It identifies mod_php as the highest risk, with a demonstrated attack before application code runs. An authentication screen or an unchanged dependency lockfile therefore does not establish protection.

The evidence differs across execution environments. The OOM corruption advisory reports confirmed remote code execution against mod_php, while describing FPM susceptibility from source analysis without a complete FPM exploit for that vulnerability. The stale global state advisory reports session lifecycle RCE validated against both mod_php and FPM, with application conditions affecting the FPM path.

These distinctions guide triage; they do not justify skipping FPM upgrades. This analysis does not establish active exploitation against your service, and unrelated scanner traffic cannot establish that these vulnerabilities were used.

The October 23 notice requires a specific combination: the application configures session.serialize_handler as php_binary or php_serialize, changes it to php at runtime with ini_set() before calling session_start(), and leaves session upload progress enabled. PHP says applications that never change the serialize handler at runtime can keep the feature enabled.

Inspect application bootstrap code, session integrations, and effective configuration before deciding that this combination is absent. If you already disabled session upload progress following October 21 guidance, the follow-up says to keep that setting in place; no additional action is needed for this follow-up.

Otherwise, PHP’s suggested precaution is session.upload_progress.enabled=0 until the next regular bugfix release. Apply it before request parsing through the appropriate administrative configuration and restart workers. The October 21 instructions explicitly say not to rely on application ini_set() or FPM .user.ini for this mitigation.

List every PHP runtime that serves the product: web pools, containers, separate admin applications, and older deployments still receiving traffic. Include scheduled jobs and queue workers in the rollout inventory so that package and image changes remain consistent, while recognizing that the announced exposure concerns web requests.

A read-only php -v check identifies the command-line executable it runs. It does not prove which PHP version your web server or FPM pool uses. Confirm the actual web runtime through your hosting control plane or restricted operational inspection; avoid publishing a diagnostic page containing configuration details.

For distribution packages, ask the vendor whether the installed package revision contains fixes for both October 21 CVEs. Backported fixes can retain an older upstream version number. PHP says Linux distributions and LTS vendors received patches in advance; that is a reason to check their security records, not proof that your host has installed them.

Use this checklist as a rollout plan, adapting it to your provider and deployment system. These are recommended checks, not tests we performed on a PHP application.

1. Select the fixed build. Use the appropriate upstream release or a vendor package with documented coverage for both CVEs. PHP 8.1 and older no longer receive normal upstream updates; establish vendor backport coverage or plan migration to a supported branch.
2. Prepare recovery. Retain the deployment configuration and a working recovery procedure. Prefer a patched fallback; reverting to an affected runtime reintroduces the security problem.
3. Roll out every instance. Replace affected images or packages, restart every PHP worker, and verify that old processes and replicas no longer serve requests.
4. Run focused smoke tests. Check sign-in, session persistence, logout, uploads, imports, and a representative customer transaction using suitable test data. Check progress indicators if disabling session upload progress changes a feature your product uses.
5. Record completion. Capture the deployed package or image identity, web runtime confirmation, restart status, smoke-test results, and remaining exceptions.

Our AI code review workflow can help structure review evidence if an assistant prepares related configuration changes.

The October 21 advisories say that updates are the complete solution for those vulnerabilities. Disabling session upload progress blocks specific session paths; it does not cover every stale-state variant or replace the OOM fix. Hiding warnings also does not protect against the stale-state issue.

Teams unable to update immediately should have their hosting provider or runtime owner evaluate the full official mitigation guidance. Memory-limit changes affect availability and require environment-specific judgment. Request-size controls and cleaner configuration can reduce exposure, but should not become a reason to leave the runtime unpatched.

Assign one owner to check the next PHP release and the promised CVE-2026-115560 advisory. Record whether upload progress remains disabled and why, then reassess after verifying the eventual fix. Our reliable workflow guide offers a useful pattern for assigning an owner and a stopping condition. Keep this security change open until both the installed fixes and the session follow-up have documented outcomes.