Last Updated: 23 October 2026

 

Running a VPS gives you greater control over your server environment, but that control also comes with the responsibility of keeping your software secure. On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow an unauthenticated attacker to execute malicious code remotely on an affected server. Both have a critical CVSS v4.0 severity score of 9.2. PHP is widely used to power websites, online stores, APIs, and other web applications. If a VPS runs a vulnerable PHP installation, the applications hosted on it may be exposed to serious security risks. VPS owners and server administrators should identify affected installations, apply the relevant security updates, and verify that the patched software is running correctly.

 

What Are CVE-2026-109618 and CVE-2026-109619?

The two vulnerabilities affect PHP's internal memory handling and request processing. Under certain conditions, exploiting these weaknesses may allow an attacker to execute code on the affected server without logging in first.

  • CVE-2026-109618: Out-of-Memory Corruption

This vulnerability is related to how PHP handles an out-of-memory (OOM) condition during request processing. In certain circumstances, PHP may interrupt a request while internal data is only partially initialized. During cleanup, the runtime may incorrectly process this data, resulting in memory corruption. An attacker may exploit this behavior to execute malicious code on a vulnerable system.

  • CVE-2026-109619: Stale Internal State

This vulnerability involves internal request-related state that may remain accessible after the memory associated with it has been released. A later request handled by the same PHP worker may use this outdated state before it has been properly reset. Under certain conditions, this may also lead to remote code execution. These vulnerabilities affect PHP itself rather than a particular website or application. Updating an application, changing its password, or installing a security plugin does not replace the need to patch the vulnerable PHP runtime.

 

Which VPS Environments Could Be Affected?

Any vulnerable PHP installation that processes web requests should be checked, regardless of the hosting platform or operating system. Potentially affected environments include:

  • Linux VPS servers running PHP-based websites and applications.
  • VPS instances using Apache, PHP-FPM, or other PHP handlers.
  • Servers running WordPress, Laravel, or other PHP-based applications.
  • Websites hosted through cPanel & WHM or Plesk.
  • Containerized applications that include an affected PHP runtime.
  • Custom web applications and API services that rely on PHP.

The PHP development team identifies Apache with mod_php as a particularly high-risk configuration. However, other PHP environments should not be assumed safe without checking their installed versions and package status. A server can continue operating normally while still running vulnerable software. This is why checking the actual PHP installation is essential.

 

Affected PHP Versions and Fixed Releases

The PHP development team has released the following fixed versions:

PHP Branch Fixed Version
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

 

These releases address both CVE-2026-109618 and CVE-2026-109619. Earlier versions within the affected branches should be updated to the relevant fixed release.

 

PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. Some operating system vendors and extended-support providers may provide backported fixes for selected older branches. If your VPS uses an older PHP version, check the applicable vendor advisory to determine whether a security patch is available. Where possible, plan to migrate to a supported PHP branch after checking application compatibility.

 

Keep in mind that a package's security status cannot always be determined by its displayed version number alone. Some vendors apply security fixes through updated package builds while retaining the original PHP version number. For the official release information, refer to the  PHP security advisory.

 

What Should VPS Owners Do?

Taking the right steps now can help reduce exposure and keep your applications running reliably.

 

1. Identify Every PHP Installation

Review the PHP versions installed on your VPS. Check the PHP runtime used by each website, subdomain, application, background service, and container. A single server may contain multiple PHP installations, and updating one does not necessarily update the others. Priorities internet-facing services, particularly those that process requests from untrusted sources.

2. Apply the Appropriate Security Updates

Update affected PHP installations to the applicable fixed releases or install the relevant security patches supplied by your operating system or software vendor. If you manage your VPS directly through SSH, check the package source and the update instructions for your environment. If you use a hosting control panel, also check its PHP packages and relevant components. After applying updates, restart or reload the affected services when required. Verify that the running applications are using the patched PHP runtime. Simply switching the PHP version selected for a website may not update every PHP installation on the server.

3. Review Your Operating System and Control Panel

Keep your VPS operating system and hosting control panel up to date. For cPanel & WHM or Plesk environments, follow the vendor's official security instructions and verify that the relevant PHP packages have been patched. For manually installed PHP versions, custom repositories, or container images, check the security status of the specific software source. A general system update should not be treated as proof that every affected component has been fixed.

4. Check Server Logs for Suspicious Activity

If your VPS was running a vulnerable PHP version before the security update, review the relevant logs and monitor the server for unusual behavior. Look for unexpected processes, suspicious requests, unauthorized file changes, unfamiliar accounts, or unusual outbound connections. If you suspect that an attacker gained access, investigate the incident and follow an appropriate recovery process. Installing the patch does not automatically remove malicious files or undo unauthorized changes that may already exist.

5. Maintain Reliable Backups

Keep recent backups of important application files, databases, and server configurations. Before making significant software changes, ensure that you have a usable backup and a clear recovery plan. After applying updates, test your applications to confirm that they work correctly. Backups are an important recovery measure, but they are not a substitute for security patching or monitoring.

 

What If You Cannot Update Immediately?

Updating to an appropriate fixed release is the recommended solution. If an immediate update is not possible, consult the official PHP advisory for applicable temporary mitigations. Where a vulnerable service cannot be secured promptly, consider isolating it from public access until the required update can be applied.

 

Temporary configuration changes should not be treated as a complete replacement for patching. The PHP development team has stated that updating is the only safe choice for fully fixing these vulnerabilities. If the server may already have been compromised, investigate it before returning it to normal operation.

 

How Does This Affect Self-Managed VPS Hosting?

VPS hosting provides flexibility and control over the software installed on your virtual server. With full root access, administrators can configure the operating system, install applications, and manage the server according to their requirements. However, this also means that security maintenance within the VPS needs appropriate attention.

 

For a self-managed VPS, the customer or designated server administrator is generally responsible for keeping the guest operating system, PHP packages, websites, and installed applications updated. Provider-level hardware and network maintenance does not automatically patch the software running inside each virtual machine. If you use cPanel, Plesk, or another control panel, follow its security guidance in addition to the recommendations for your operating system.

 

How VPSSell Fits Into Your Server Security

VPSSell provides Linux VPS, Windows VPS, Container VPS, and Storage VPS solutions for websites, applications, and other online projects. Our VPS platform provides server management tools and root access, allowing customers to configure their environments and manage the software required for their workloads. Technical support is available for assistance with the VPSSell platform.

 

Customers operating self-managed VPS instances should maintain a regular update schedule and verify that security patches are applied to their installed software. If you need help identifying the appropriate update process, consult the relevant software documentation or contact technical support for guidance. You can explore the available VPS solutions at  VPSSell.com.

 

Final Recommendations

CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that may allow unauthenticated attackers to execute malicious code on affected servers.

 

VPS owners should review their PHP installations, apply the appropriate security patches, and confirm that the updated software is running correctly. Regular patch management, server monitoring, tested backups, and timely incident investigation are important parts of maintaining a secure VPS environment. Do not assume that your server is protected simply because it is running normally. Identify the software that needs attention, follow the relevant vendor guidance, and verify that the required fixes have been applied.

 

More Information

For official technical details and platform-specific remediation instructions, refer to the following resources: