# Critical PHP Security Flaws: What Website Owners Need to Check Now > PHP has released fixes for two critical flaws. Australian website owners should confirm their hosting is patched and ask about a further session-handling warning. - Canonical URL: https://techxtelco.com/news/critical-php-vulnerabilities-october-2026/ - Published: 2026-10-24 - Updated: 2026-10-24 - Topics: Technology, Security, News - Author: David Everson - Image: https://anrkjmgqmwfosbvyzrzc.supabase.co/storage/v1/object/public/article-images/critical-php-vulnerabilities-october-2026/hero-v1.webp - Publisher: Tech X Telco (https://techxtelco.com) Australian website owners should ask their hosting provider to confirm that critical PHP security updates have been applied. ASD’s Australian Cyber Security Centre says patches are available for two vulnerabilities in the technology behind many web applications, and recommends identifying affected workloads, updating them and monitoring for suspicious activity. **Quick answer** Ask for the PHP version or vendor patch reference protecting the system that serves your website. The original flaws are CVE-2026-109618 and CVE-2026-109619. Also ask about the maintainers’ 23 October follow-up warning concerning a narrow session-handling configuration. ## What the Original Flaws Affect The PHP maintainers describe the original vulnerabilities as capable of unauthenticated remote code execution: an attacker may be able to make a vulnerable server execute code without first logging in. Their warning covers PHP installations handling web requests, including common server arrangements such as PHP-FPM and Apache’s mod\_php. The two advisories concern different memory-handling failures. One involves corruption during an out-of-memory error. The other involves internal state surviving after the memory behind it has been released. For an owner whose site is managed by somebody else, the important action is to establish whether that organisation has addressed both advisories. ### Versions Released for the Two Original Flaws - PHP 8.2: 8.2.35. The patched release listed in both original advisories. - PHP 8.3: 8.3.36. The patched release listed in both original advisories. - PHP 8.4: 8.4.27. The patched release listed in both original advisories. - PHP 8.5: 8.5.12. The patched release listed in both original advisories. Those numbers identify the upstream fixes for the two original CVEs. They are not a recommendation to downgrade a newer patched release. PHP says distribution and long-term-support vendors may provide backported fixes, so a provider using a vendor-maintained package should identify its security update rather than relying on a bare version number. ## The Additional Warning on 23 October A subsequent PHP notice recommends disabling session upload progress until the next regular bugfix release to address an unlikely remote-code-execution path. The maintainers describe an unusual combination: an application starts with php\_binary or php\_serialize session handling, switches to php at runtime before starting the session, and leaves upload progress enabled. This follow-up does not erase the need for the original updates. It means the administrator should also assess that configuration and the latest official advice. If the earlier session-upload-progress mitigation is already in place, PHP says to keep it. Owners should forward the notice to their administrator rather than make unfamiliar production configuration changes themselves. ## What to Ask Your Hosting Provider ### A Practical Check for Website Owners 1. Identify the workload. Ask whether your website, application or hosting account uses PHP and which team is responsible for maintaining its web-serving runtime. 2. Confirm both original fixes. Request the installed release or vendor security reference for CVE-2026-109618 and CVE-2026-109619. Ask when the change was completed. 3. Raise the follow-up notice. Ask the administrator to assess the 23 October session-upload-progress advice and record whether action is needed for your application. 4. Ask about monitoring. Confirm who is checking PHP applications and related systems for suspicious activity, as recommended by the ACSC. 5. Close the loop. Keep the response with your maintenance records. If the work is still pending, ask for the responsible person, the proposed timing and an update when it is complete. A useful request is specific: please confirm that the PHP runtime serving this site has the fixes for both named vulnerabilities, identify the release or vendor patch, and confirm whether the later session warning applies. This is an editorial example of a support request, not confirmation that your own provider has completed the work. Avoid treating a general website update, a working homepage or the absence of an alert as proof that the PHP runtime has been patched. Ask for evidence tied to the actual hosting environment. Likewise, applying an update should not be presented as proof that no earlier compromise occurred; that is a separate question for the team reviewing the system. The ACSC’s alert had been reviewed on 22 October, while PHP’s additional notice is dated 23 October. The regulator page retains older pre-release background wording, so the recent-update section and the maintainers’ current guidance are the useful references for the patching decision. ## Sources and How This Was Checked This article is based on the official pages below, read on 23 October 2026. The ACSC alert’s recent-update section was checked against the PHP maintainers’ release notices and both original advisories. The separate 23 October informational advisory is distinguished from the original patches. No exploit or server configuration was tested. The practical recommendations are editorial guidance. No hands-on test was performed. ### Official Pages Used - [ASD’s ACSC: Critical vulnerabilities in PHP](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php): Recent update confirms patches; inventory, official guidance, updating and monitoring. Older background text retained on source. - [PHP maintainers: Security release and session upload progress update](https://www.php.net/index.php): 21 October release announcement and 23 October informational advisory: affected web workloads, legacy support and narrow residual session configuration. - [PHP advisory: CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w): Patched versions, severity and out-of-memory corruption summary. - [PHP advisory: CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp): Patched versions and stale global state summary; mitigations are incomplete.