Last Updated: 23 October 2026

 

A reliable VPS environment needs more than good performance and sufficient resources. Keeping the operating system, server software, and applications updated is essential for protecting your websites and services. On 21 October 2026, the PHP development team released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

 

These vulnerabilities could allow an unauthenticated attacker to execute malicious code remotely on an affected server. Both have a CVSS v4.0 severity score of 9.2, placing them in the critical category. PHP is widely used for websites, content management systems, APIs, and business applications. If your VPS runs a vulnerable PHP installation, the applications hosted on it may be exposed to serious security risks.

 

VPS owners and server administrators should review their environments, apply the appropriate security updates, and verify that the affected software is protected.

 

What Are These PHP Vulnerabilities?

Both vulnerabilities affect the way PHP handles memory and internal request data. Under certain conditions, an attacker may exploit these issues to execute code remotely on an affected server without authenticating first.

  • CVE-2026-109618: Out-of-Memory Corruption

This vulnerability is related to how PHP handles an out-of-memory (OOM) condition during request processing. In certain circumstances, PHP may interrupt processing while internal request data is only partially initialized. During cleanup, the runtime may incorrectly handle this data, potentially resulting in memory corruption. An attacker may exploit this behavior to execute malicious code on the affected server.

  • CVE-2026-109619: Stale Internal State

This vulnerability involves internal request-related state that remains accessible after the memory associated with it has been released. A later request handled by the same PHP worker may access this outdated state before it has been properly reset. Under certain conditions, this may also lead to remote code execution. These vulnerabilities affect the PHP runtime itself. Updating a website's CMS, changing application passwords, or installing a security plugin does not resolve an unpatched PHP installation.

 

Which VPS Environments Could Be Affected?

Any server running a vulnerable PHP installation that processes web requests should be assessed. Potentially affected environments include:

  • Linux VPS servers running PHP-based websites and applications.
  • Windows VPS environments hosting PHP applications.
  • WordPress websites and other content management systems.
  • Web applications built using frameworks such as Laravel.
  • VPS servers using Apache with mod_php, PHP-FPM, CGI-based PHP, FrankenPHP, or LiteSpeed.
  • Containers and custom application environments that include vulnerable PHP packages.

The PHP development team has identified Apache with mod_php as a particularly high-risk configuration. However, administrators should not assume that other PHP configurations are safe without checking their installed versions and security status. A server may continue operating normally while vulnerable software remains installed. Regular security checks are therefore important, even when no website errors or other obvious problems are visible.

 

Affected PHP Versions and Fixed Releases

The PHP development team has released the following security updates:

PHP Branch First Fixed Release
PHP 8.5 8.5.12
PHP 8.4 8.4.27
PHP 8.3 8.3.36
PHP 8.2 8.2.35

 

Earlier versions within these branches should be updated to the applicable fixed release. PHP 8.1 and older versions no longer receive regular security updates directly from the PHP project. Some operating system vendors and extended-support providers may offer backported fixes for selected older versions.

 

If your VPS uses an older PHP branch, check the relevant vendor advisory to establish whether an applicable security fix is available. Where possible, plan to migrate to a supported PHP version after checking compatibility with your applications. It is also important to verify the actual package or build installed on the server. Some vendors apply security fixes without changing the main PHP version number.

 

For the complete technical details, visit the  official PHP security advisory.

 

What Should VPS Owners Do Now?

A structured approach to security updates can help reduce exposure and minimize disruption to your applications.

 

1. Identify All PHP Installations

Check which PHP versions are installed on your VPS. Review the PHP runtime used by each website, subdomain, background service, and container. A single VPS may have several PHP versions installed, and updating one does not automatically update the others. Start with internet-facing applications and services that process requests from untrusted sources.

2. Apply the Appropriate Security Updates

Update vulnerable PHP installations to the relevant fixed release or apply a supported vendor-provided security patch. If you manage your VPS through SSH, check the package source and the relevant update instructions for your operating system. If you use a hosting control panel, verify the PHP packages managed by that panel as well.

After updating, restart or reload the relevant services when required and confirm that the running applications are using the patched runtime. Simply changing the PHP version selected for a website does not necessarily update every affected PHP installation on the server.

3. Review Your Operating System and Server Software

Keep your VPS operating system, web server, hosting control panel, and other installed components updated. If your environment uses cPanel & WHM or Plesk, follow the official security guidance published by the respective vendor. If PHP was installed manually, through a third-party repository, or as part of a container image, check whether that specific source has an applicable security update. Do not assume that a general operating system update has patched every PHP installation.

4. Monitor the Server for Suspicious Activity

If your VPS was running a vulnerable PHP version before the update, review relevant logs and investigate unusual activity. Look for unexpected processes, suspicious requests, unfamiliar accounts, unauthorized file changes, or unusual outbound connections. If you suspect that an attacker has accessed your server, investigate the incident promptly. Applying the security patch does not automatically remove malicious files or reverse changes that may have occurred before the update.

5. Maintain Reliable Backups

Keep recent backups of your applications, databases, and important server configurations. Before significant server changes, verify that you have a usable backup and a clear recovery plan. After applying updates, test your websites and applications to confirm that they continue to work correctly. Backups are an important part of recovery planning, but they should be used alongside security updates and monitoring.

 

What If You Cannot Update Immediately?

Installing the appropriate security update is the recommended solution. The PHP development team has stated that there are no complete mitigations for these vulnerabilities. If you cannot patch an affected system immediately, consult the official PHP advisory for any temporary measures applicable to your environment. Assess whether the vulnerable service can be isolated from public access until the required update is applied. If the system cannot be secured promptly, taking the affected service offline may be necessary.

 

Temporary measures should not be treated as a permanent replacement for patching. If you believe your VPS has already been compromised, investigate possible unauthorized access and follow an appropriate incident response process before returning the system to normal operation.

 

Understanding Security Responsibilities in VPS Hosting

VPS hosting provides greater control over your server environment, allowing you to choose an operating system, install applications, and configure the software required for your projects. However, security responsibilities depend on the service and management arrangement you use. For a self-managed VPS, customers or their designated administrators are generally responsible for maintaining the guest operating system, PHP packages, applications, and other installed software.

 

Provider-level maintenance of physical hardware and network infrastructure does not automatically patch PHP running inside your virtual machine. If you use a managed server service, confirm which software updates, security checks, backups, and monitoring tasks are included in your management plan. Knowing who is responsible for each task helps prevent important security updates from being overlooked.

 

How VPS Hosting.LK Fits Into Your Server Security

VPS Hosting.LK offers VPS solutions for websites, business applications, development environments, and other workloads requiring flexible server resources. Available options include Linux VPS, Windows VPS, and Storage VPS, with configurable environments that allow customers to select the software and tools appropriate for their needs.

 

For customers managing their own VPS, regular maintenance should include PHP security updates, operating system patching, application updates, monitoring, and reliable backups. If you need assistance with your VPS environment, consult the relevant technical documentation or contact the support team to understand the available assistance and management options. You can explore the available plans and VPS solutions at  VPS Hosting.LK.

 

Final Recommendations

CVE-2026-109618 and CVE-2026-109619 highlight how vulnerabilities in a widely used component such as PHP can create security risks for websites and server infrastructure.

 

VPS owners should identify their PHP installations, apply the appropriate security updates, and confirm that the patched software is running. They should also monitor for suspicious activity and maintain reliable backups. A secure VPS environment requires ongoing attention, not just a one-time update. Regular patch management, sensible server configuration, and a clear recovery plan all contribute to more reliable hosting. Do not assume your server is protected simply because it is working normally. Review the installed software, follow the relevant vendor guidance, and verify that all necessary updates have been applied.

 

More Information

For official technical details and platform-specific remediation guidance, refer to the following resources: