On 21 October 2026 the PHP project released emergency fixes for two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both allow an unauthenticated attacker to run code on a web server that uses PHP, both are rated CVSS 9.2, and proof-of-concept code is public. The Australian Signals Directorate has issued a critical alert. If your BinaryLane server runs PHP, update it today.
⚠️ Critical: this affects any PHP installation, not one application. WordPress, Laravel, Drupal, Nextcloud, phpMyAdmin and every other PHP site is exposed through the PHP runtime underneath it. Updating the application does not fix it; PHP itself has to be updated.
At a glance
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Severity | Critical (CVSS 9.2) |
| Type | Memory corruption in PHP core, unauthenticated remote code execution |
| Affected | All PHP versions before the fixed releases below; PHP 8.1 and older receive no fix from the PHP project |
| Fixed releases | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Worst case | Apache with mod_php (no application code has to run). PHP-FPM is also exploitable |
| ACSC alert | cyber.gov.au: Critical vulnerabilities in PHP |
Read this article if you run a website or application written in PHP on a BinaryLane server. BinaryLane's platform, mPanel and the API do not use PHP and are not affected.
Step 1 — Check your PHP version
php -v
If the version is lower than the fixed release for its branch (8.5.12, 8.4.27, 8.3.36, 8.2.35), or if you are on 8.1 or older, continue.
On Debian and Ubuntu the distribution backports the fix without changing the headline version, so check the package version instead:
dpkg -l 'php*-common' | grep ^ii
| Distribution | Fixed package version (or later) |
|---|---|
| Ubuntu 24.04 | php8.3 8.3.6-0ubuntu0.24.04.13 |
| Ubuntu 22.04 | php8.1 8.1.2-1ubuntu2.28 |
| Ubuntu 26.04 | php8.5 8.5.4-0ubuntu1.5 |
| Debian 13 | php8.4 8.4.27-1~deb13u1 |
| Debian 12 | php8.2 8.2.35-1~deb12u1 |
For other distributions check their security tracker and apply the PHP update as soon as it is published.
Step 2 — Update PHP
Debian / Ubuntu
sudo apt update sudo apt install --only-upgrade 'php*'
Then restart PHP and your web server, using the ones you have:
sudo systemctl restart php8.3-fpm # php8.1-fpm, php8.2-fpm, php8.4-fpm as applicable sudo systemctl restart apache2 # or: sudo systemctl restart nginx
RHEL, AlmaLinux, Rocky Linux
sudo dnf update 'php*' sudo systemctl restart php-fpm httpd
cPanel / WHM
cPanel ships its own PHP builds (EasyApache). Run the cPanel updater and update the PHP packages:
/scripts/upcp --force yum update 'ea-php*' # dnf on AlmaLinux 8/9
Check cPanel's security advisory for the builds that contain the fix.
Windows (IIS)
Download the fixed build for your branch from windows.php.net and restart IIS.
Docker / containers
A host update does not change PHP inside a container. Rebuild from an updated base image (for example php:8.3-fpm pulled after 21 October 2026) and redeploy.
Step 3 — Confirm
Run php -v (or the dpkg command above) again and confirm the version is at or above the fixed release. Load your site to confirm it still works.
If you cannot patch immediately
Take the PHP site offline, or restrict access to it to known IP addresses using your server's Cloud Firewall in mPanel, until you can update. PHP 8.1 and older will not receive a fix from the PHP project; if your distribution has not backported one, plan an upgrade to a supported PHP release or operating system.
What BinaryLane does and does not do
BinaryLane servers are self-managed. We do not log in to customer servers or apply updates on your behalf. This article gives you everything needed to patch yourself; if you need hands-on help, a systems administration service can do it for you.