Important PHP Security Update: What Website Owners Need to Do

On 21 October 2026, the PHP project shipped an emergency security release fixing two critical vulnerabilities that can let an attacker run code on your server without logging in. Both flaws are rated 9.2 (Critical) under CVSS v4.0, and the PHP team's message is simple: update now.

If your website, admin panel, API or online store runs on PHP — including WordPress, Laravel, CodeIgniter or custom PHP apps — this update applies to you. Here is what happened and exactly what you need to do.

What happened?

On 20 October 2026, the PHP security team gave advance notice of a critical release. Patches went live the next day as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The two issues — informally nicknamed "PHP2Shell" by researchers — are:

• CVE-2026-109618 – RCE via out-of-memory corruption: when PHP runs out of memory mid-request, internal request data can be left half-initialised. Cleanup code may then treat that broken data as valid, which an attacker can abuse.
• CVE-2026-109619 – RCE via stale global state: some internal state can survive after its memory has been freed. A later request handled by the same PHP worker may use that stale data before it is reset.

In plain words: a specially crafted web request can trick PHP into running the attacker's code — and in some setups this happens before your application code even starts, so a secure app does not protect you on its own.

Who is at risk?

According to PHP's advisory, every PHP installation that serves web requests is at risk, including:

• PHP-FPM (Nginx and most modern hosting)
• Apache with mod_php — rated the highest risk, with a demonstrated unauthenticated exploit
• php-cgi, FrankenPHP and LiteSpeed

Sites still on PHP 8.1 or older are in the most difficult position, because the PHP project no longer ships official releases for them.

Which version should you be on?

Your PHP branch	Update to (minimum)	Note
PHP 8.5	8.5.12	Supported
PHP 8.4	8.4.27	Supported
PHP 8.3	8.3.36	Supported
PHP 8.2	8.2.35	Security support ends 31 Dec 2026 — plan an upgrade
PHP 8.1, 8.0, 7.x	Upgrade to 8.3+	No official release; only vendor/LTS backports or source patches

What website owners need to do

1. Check your PHP version

• cPanel / Plesk / hosting dashboard: look under "Select PHP Version" or "PHP Settings".
• WordPress: go to Tools → Site Health → Info → Server.
• Your own server: run php -v — and remember the web server may use a different PHP than the command line, so also check a phpinfo() page (delete it afterwards).

2. Update PHP

• Shared or managed hosting: your provider applies the update. Raise a ticket and ask them to confirm the October 2026 PHP security patch is installed on your account.
• VPS / dedicated / cloud servers: Linux distributions received patches in advance — install your distro's updated PHP packages (e.g. via apt or dnf). Docker users should rebuild images on the new official PHP base images.
• Using the Remi repository? PHP has advised switching to distribution packages or building from source, as that volunteer repo may lag behind.

3. Restart every PHP worker

Installing packages is not enough — old PHP processes keep running the vulnerable code. Restart PHP-FPM, Apache or LiteSpeed on every server, including queue workers, cron hosts and staging.

4. Verify

Re-check the version shown by your web server, then test key pages: login, checkout, payments, forms and file uploads.

Can't update today? Temporary hardening

PHP is clear that only updating fully fixes the problem. But if you need a few hours, these settings (from PHP's advisory) reduce exposure to known attack paths:

• Set session.upload_progress.enabled = 0 in php.ini or your FPM pool config and restart all workers. Do not rely on ini_set() or .user.ini.
• On PHP 8.5, set fatal_error_backtraces = 0 and restart.
• Lower post_max_size — about 8M if you don't accept uploads, 32M if you do — and keep upload_max_filesize below it.
• Enforce request-size and field-count limits at your web server, proxy or WAF. Cloudflare has rolled out WAF rules for the known exploit vectors, including on its Free plan.

Treat these as a stop-gap, not a fix.

A quick checklist

• ☐ List every site, server, container and staging box running PHP
• ☐ Confirm each one is on 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later
• ☐ Restart PHP-FPM / Apache / LiteSpeed everywhere
• ☐ Get written confirmation from your hosting provider
• ☐ Plan a move off PHP 8.2 before 31 December 2026, and off 8.1 or older right away
• ☐ Review server logs for unusual requests or new files since 20 October

Why this matters for fintech and payment businesses

For retailers, agents and businesses running payment, recharge, BBPS or AEPS portals, a compromised server can mean leaked customer data, tampered transactions and stolen API keys. If your server could have been exposed, rotate your API keys, callback secrets and database passwords after patching.

At Pay2All, we track security advisories like this closely and keep our platform patched. If you integrate with Pay2All APIs from your own PHP server, please update today — and reach out to our support team if you need help regenerating your API keys.

Sources: PHP.net security advisory and release notes (21 October 2026). Details are accurate at the time of writing; always follow the latest guidance from php.net and your hosting provider.