The October 2026 PHP RCE flaws: a patch plan for home-grown business apps

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution. In plain words: on an unpatched server, an attacker who can send web requests to your app may be able to run their own code on it, without logging in.

This matters far beyond WordPress. Many small businesses run home-grown CRMs, booking systems, admin panels and internal tools on PHP frameworks such as Laravel, often built years ago by a freelancer and rarely touched since. If that describes your business software, this post is a practical plan for this week, and for keeping it maintained afterwards.

What was fixed

The PHP security advisory and the PHP Foundation's write-up describe two related flaws:

• CVE-2026-109618, remote code execution via out-of-memory corruption. If a request hits PHP's memory limit at exactly the wrong moment, PHP can leave half-initialized internal data behind and later treat it as valid.
• CVE-2026-109619, remote code execution via stale global state. A fatal error at the wrong point can leave internal state pointing at memory from a previous request, which a later request on the same worker may then use.

Both sit in memory management and error handling, which nearly every request touches. The PHP project lists every installation that serves web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php highest risk, with a demonstrated exploit that runs before any application code.

Security vendors report that exploitation attempts began quickly. Check Point's October 26 threat intelligence report says attack traffic rose sharply after disclosure, and that as of October 23 most publicly visible PHP instances did not show patched versions.

Step 1: Find every PHP app you own

Small businesses often forget about some of their PHP software. Make a list that includes:

• your main business app or CRM,
• any WordPress or other CMS sites, including old campaign sites,
• admin panels, staff portals and booking tools,
• staging or demo copies that are still online,
• apps on shared hosting that a former developer set up.

For each, note where it runs (shared hosting, a VPS, a cloud platform, a container) and who has access to update it.

Step 2: Check the PHP version

Find the exact PHP version each app is running. On shared hosting, it is usually shown in the hosting control panel's PHP settings. On a server, an administrator can run php -v for the command line, but also check the web runtime itself (for example the PHP-FPM version), because the two can differ.

You are on a fixed release if the version is at least:

| Branch | First fixed version | | --- | --- | | PHP 8.5 | 8.5.12 | | PHP 8.4 | 8.4.27 | | PHP 8.3 | 8.3.36 | | PHP 8.2 | 8.2.35 |

Linux distributions received the patches in advance, so a distribution package may carry the fix under its own version string. Check your vendor's security notice rather than the number alone.

PHP 8.1 and older no longer receive official updates. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source, and some vendors offer backports. AWS's security bulletin is blunt that migration to a supported branch is required for end-of-life runtimes.

Step 3: Patch, then restart every worker

Update PHP through your host, your distribution's packages, or your container base image. Then make sure every PHP worker actually restarts. A long-running PHP-FPM pool, or a container that was never rebuilt, can keep running the old code after the package is updated.

For containers, rebuild images from an updated base image and redeploy them. For managed platforms, check the provider's notice: AWS, for example, says Elastic Beanstalk customers with managed platform updates enabled receive the fix in their next maintenance window, while others need to update their platform version.

Step 4: If you truly cannot patch today

The PHP advisory lists temporary measures that reduce exposure to specific attack paths, while stressing that only an update is a complete fix. They include:

• for the out-of-memory flaw, lowering post_max_size and enforcing request-size limits at the web server or proxy;
• for the stale-state flaw, setting session.upload_progress.enabled=0 in php.ini or the FPM pool configuration (not ini_set() or .user.ini), then restarting every worker.

Treat these as a bridge measured in days, not a solution. Read the advisory itself before applying them, because some settings have side effects (for example on file uploads).

Step 5: Check whether anything happened before you patched

Because exploitation started within days, a server that stayed unpatched for a while deserves a look:

• look for new or modified PHP files in upload and cache folders,
• review new admin users in your app and CMS,
• check for unfamiliar scheduled tasks or outgoing connections,
• rotate database passwords, API keys and email credentials stored in the app's configuration.

If you find signs of compromise, restore from a known-good backup onto a patched server rather than cleaning in place.

The bigger lesson: business software needs a maintenance plan

Custom business software is often built once and then left alone because it works. Events like this show the cost of that approach: the risk was in the runtime underneath the app, not in anything the business changed. A light, regular maintenance plan prevents most emergencies.

What a minimal maintenance plan covers

• An inventory of every app, where it runs, its runtime version and who can deploy it.
• A supported runtime. Keep each app on a PHP branch that still receives security fixes, and plan upgrades before end-of-life dates.
• Framework and dependency updates on a regular schedule, tested on a staging copy first.
• Backups you have restored at least once, so you know they work.
• Security notices you actually receive, from PHP, your framework and your host.
• Access hygiene: remove former developers' accounts and rotate shared credentials.

Signs your app needs more than a patch

If an upgrade to a supported PHP version breaks the app, if nobody has the source code, or if the original developer is unreachable, the app has become a business risk. That is the moment to plan a careful upgrade or a rebuild on a stack your team can own, rather than waiting for the next critical advisory.

Key takeaways

• PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated remote code execution flaws.
• Every PHP app serving web requests is in scope, not just WordPress.
• Patch, restart every worker, and rebuild containers.
• Temporary configuration changes reduce risk but do not replace the update.
• Home-grown business software needs a regular maintenance plan, not just emergency fixes.

---

Not sure which of your business apps are exposed? Our CRM and team tools work includes maintaining and upgrading software like this. Book a free technical assessment, and we'll check your runtimes and tell you what to fix first.