Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: what Skyline customers need to know

22 October 2026. On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as "php2shell". Both can allow an unauthenticated attacker to run code on a server that runs PHP. We have updated PHP on Skyline Cloud hosting. This post explains who is affected, which versions fix the problem, and what you need to do, depending on how your site is hosted.

Summary

• The two flaws are in PHP itself, not in one application or plugin.
• Both are rated Critical, with a CVSS v4.0 score of 9.2 (the PHP project's own rating).
• They affect PHP installations that serve web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups that use mod_php are at the highest risk.
• They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says updating is the only complete fix.
• Details became public before the patch (the CVE IDs were posted on 20 October), and security firms expect public exploits soon. Update now rather than later.

What the two vulnerabilities are

CVE-2026-109618: remote code execution via out-of-memory corruption

When PHP runs out of memory, its out-of-memory handling can interrupt it while internal request data is only partly set up. The cleanup that follows may then treat that invalid data as valid. PHP advisory: GHSA-w8hw-w9fx-j79w.

CVE-2026-109619: remote code execution via stale global state

Internal state that belongs to one request can survive after its memory has been freed, and a later request handled by the same PHP worker may use it. PHP advisory: GHSA-6wmf-4rv5-p3rp.

Who is affected

Any website or application that runs on a PHP version without these fixes, where PHP serves web requests. The framework or CMS does not matter: WordPress, Laravel and custom PHP code all run on the same PHP engine.

PHP 8.1 and older no longer receive official releases. The PHP team has published source backports for 7.4, 8.0 and 8.1 for anyone who builds PHP from source, but its advice is to upgrade to a supported version.

What Skyline has done

On 22 October 2026 we updated PHP on our Skyline Cloud hosting servers and our web platform servers to the fixed versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) and restarted PHP. We checked customer sites after the update.

For sites still on PHP 7.4, 8.0 or 8.1 we installed the latest LiteSpeed builds. The PHP project no longer publishes official fixes for those versions, so we cannot describe them as fully patched. That is why we are asking sites on them to move to a newer version.

What you need to do

Skyline Cloud Hosting on PHP 8.2 or newer

Nothing. Your site already runs a fixed version.

Skyline Cloud Hosting on PHP 7.4, 8.0 or 8.1

We strongly recommend switching the site to PHP 8.2 or newer. In S Panel, open the PHP version selector for the website and choose 8.2, 8.3, 8.4 or 8.5. Older code sometimes needs small changes to run on a newer PHP version, so if you are not sure your site is ready, open a support ticket first. Our team can help you test the site before you switch.

Your own VPS or cloud server (self-managed)

On a server you manage yourself, applying the update is your job:

1. Update PHP from the source you installed it from, for example sudo apt update && sudo apt upgrade on Ubuntu or Debian, or your distribution's security update.
2. Check the result with php -v, and also check the version your web server actually uses, which can differ from the command line.
3. Restart PHP-FPM and your web server so the new version is loaded, for example sudo systemctl restart php8.3-fpm.
4. If the server runs PHP 8.1 or older, plan an upgrade to a supported version.

If you would like help, open a support ticket and tell us which server it is.

Frequently asked questions

Is my WordPress site affected?

WordPress runs on PHP, so what matters is the PHP version, not WordPress itself. If your site is on Skyline Cloud Hosting with PHP 8.2 or newer, it is already updated.

Do I need to restart anything on Skyline Cloud Hosting?

No. We restarted PHP after the update.

Can a firewall protect me instead of updating?

The PHP project says updating is the only complete fix. Update PHP, or move to a supported version.

My site runs PHP 8.1. Is it safe?

PHP 8.1 and older get no official fixes. We installed the latest LiteSpeed builds for them, but the recommended fix is to move to PHP 8.2 or newer. Support can help you test the site first.

Need help?

Open a support ticket in the Skyline Cloud portal at cloud.alskyline.com/support/new, or email sales@alskyline.com. Tell us the domain or server and the PHP version it runs, and we will take it from there. The same notice is also published on Skyline Cloud.

Sources

• PHP project security announcement, 21 October 2026: php.net/archive/2026.php
• CISA alert, 21 October 2026, "Critical Vulnerabilities in PHP Require Immediate Patching": cisa.gov