On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under CVSS v4.0. These vulnerabilities may allow unauthenticated remote code execution, potentially compromising the security of websites, applications, and their data.

The first vulnerability involves improper memory handling under out-of-memory conditions, while the second involves the possibility of accessing internal data after its allocated memory has been freed. Both vulnerabilities affect PHP runtime environments used to serve websites, including PHP-FPM, Apache, and LiteSpeed. Exploitation does not necessarily require a vulnerability in the website's own application code.

According to the official PHP security announcement, fixes have been released in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Users running affected versions are urged to update immediately, as installing the security patches is the complete solution to these vulnerabilities. Temporary mitigations alone cannot prevent all potential exploitation methods.

To ensure protection, PHP installations on websites and servers should be updated to patched versions. Systems running versions that have reached end of life should migrate to an officially supported PHP version to continue receiving security updates. Some operating system vendors and extended-support providers may also supply security patches for older PHP versions without changing their underlying PHP version number.

What Does This Mean for IQ Hosting Customers?

Our technical team has already completed the deployment of all necessary security updates and patches addressing both vulnerabilities across all PHP versions available within our managed hosting services, including older versions for which security patches have been provided by the relevant vendors.

Therefore, no action or intervention is required from customers using our managed hosting services, as the necessary updates have already been applied at the server level. For unmanaged Virtual Private Servers (VPS) and dedicated servers, updating PHP and securing the runtime environment remain the responsibility of the respective server administrators.