A critical issue in the PHP runtime has been disclosed and fixed. Your PHPue code does not need to change, but the PHP version on your server does.
On 21 October 2026 the PHP project released security updates for two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619. Under certain conditions they can let an attacker run code on a web server without logging in.
The issue is in the PHP runtime, not in any framework or application. It affects every PHP application, whatever it is built with, and the fix is the same for everyone: run a patched version of PHP.
The UK's National Cyber Security Centre (NCSC) has published an alert with its recommended actions: Critical security issue affecting PHP (NCSC).
No PHPue release or code change is needed. PHPue compiles your .pvue files to plain PHP, so once your server runs a patched PHP version, your application is covered.
This is where action is needed. Check which PHP version your hosting runs and update it, or confirm that your host has applied the fix.
Make sure your server runs one of these versions or newer:
PHP 8.1 and older are end-of-life and no longer receive official releases. If your hosting still runs one of them, move to a supported version (8.2 or newer). Some Linux distributions and hosts apply the fix to their own PHP builds without changing the version number, so if your version looks older, ask your host whether the fix for these CVEs has been applied.
Log in to your hosting control panel and open its PHP settings (often called Select PHP Version, MultiPHP Manager or PHP Configuration). With SSH access, you can run php -v instead.
Choose the newest supported PHP version your host offers that matches or exceeds the versions listed above, and apply it to your site. PHPue works with every supported PHP version (8.2 and newer).
Ask your hosting provider when the fix for CVE-2026-109618 and CVE-2026-109619 will be applied to your account. Most hosts roll out security updates for their servers themselves.
Until you can update, you can turn off a PHP feature linked to these issues. Add this line to your site's php.ini or .user.ini (or set it in your control panel's PHP options):
This reduces the risk but does not remove it. Updating PHP is the only complete fix.
If your site ran an unpatched version while the issue was public, look through your hosting file manager for files you don't recognise, and review your hosting account's access logs. If you find anything suspicious, contact your host and follow the NCSC's guidance.
Official Docker images such as php:8.2-fpm are updated with the fix, but containers you have already built keep the old PHP until you rebuild them:
On your own server, install your distribution's PHP security updates and restart PHP-FPM or your web server. Remember any other PHP-based tools on the same server, such as phpMyAdmin.
This page was last updated on 21 October 2026 and will be updated if the guidance changes.