PHP 8 Critical RCE (CVE-2026-109618 & CVE-2026-109619): How We Patched in 10 Minutes

What happened: Critical PHP 8 remote code execution flaws

The official PHP development team released emergency security updates across all supported release branches: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

These updates patch two critical vulnerabilities:

• CVE-2026-109618: Memory boundary corruption in PHP’s request stream parser.
• CVE-2026-109619: Improper boundary validation in multipart header handling leading to arbitrary memory write.

Combined, these flaws allow an unauthenticated remote attacker to execute arbitrary software code directly on your web server.

An attacker does not need a username, an admin account, or an active session. They only need to send a single crafted HTTP request to your website. Once triggered, the flaw allows the attacker to execute shell commands with the full privileges of your web server user (www-data, nginx, or apache).

If your server runs an unpatched version of PHP 8, your site is vulnerable right now.

Which systems are affected

This is not a bug in WordPress, Laravel, or Symfony. It is a vulnerability inside core PHP itself. Any application running on unpatched PHP is vulnerable:

If your web server runs PHP 8.1, 8.0, or 7.4, the official PHP project has discontinued security patches for those versions. Your server remains permanently exposed unless you upgrade to a supported release or your Linux distribution provides backported patches.

How attackers exploit this in the wild

Within hours of a critical RCE disclosure, automated scanning botnets scan the internet for unpatched servers. The attack pattern follows four direct phases:

1. Automated mass scanning: Botnets send exploit probe requests across public IP addresses on ports 80 and 443.
2. Arbitrary memory write: The malformed payload triggers the parser flaw, bypassing standard input sanitization.
3. Web shell injection: The attacker writes a persistent backdoor script into temporary directories (/tmp or upload folders).
4. Data theft and persistence: The attacker dumps database credentials from .env or wp-config.php, exfiltrates customer data, installs cryptominers, or holds database records for ransom.

Because web servers must keep ports 80 and 443 open to serve public traffic, traditional network firewalls do not stop this attack unless an edge application firewall specifically filters the malformed request signature.

How FixrWeb patched all clients within 10 minutes

FixrWeb manages dedicated cloud servers, WordPress platforms, and custom web applications for businesses worldwide. When this security bulletin was released, our team completed full remediation across all customer production servers in under 10 minutes:

1. Edge virtual patch deployed in 3 minutes

Before touching running server binaries, our infrastructure team deployed a custom Web Application Firewall (WAF) rule across our Cloudflare edge network.

The rule inspects incoming multipart request headers and drops malicious exploit signatures at the edge. This blocked attacks before requests could ever touch origin customer servers, giving us complete protection while packages were verified.

2. Canary node validation in 2 minutes

Never apply unverified packages directly to production. We updated an isolated canary node running the exact client stack (PHP 8.4-FPM, OPcache, Redis, and MySQL connections) to confirm:

• The update resolved the vulnerability.
• No extension brokenness or memory leaks occurred.
• Application test suites passed with 100% success.

3. Rolling zero-downtime cutover in 5 minutes

We deployed the updated PHP binaries across our server fleet using rolling zero-downtime service reloads.

By sending a SIGUSR2 signal to the PHP-FPM master process, running workers finished existing web requests safely while new workers spawned with the patched binaries.

• Downtime: 0 seconds.
• Dropped customer requests: 0.
• Client impact: Zero security incidents or breaches.

How to fix and update your server right now

If you manage your own cloud server (DigitalOcean, AWS, Hetzner, Linode, or Vultr), follow these exact steps to update your systems immediately.

Step 1: Check your current PHP version

Open your server terminal via SSH and run:

php -v

Also check the active PHP-FPM service version:

php-fpm8.4 -v || php-fpm8.3 -v || php-fpm8.2 -v

If your version is lower than 8.2.35, 8.3.36, 8.4.27, or 8.5.12, proceed with updating immediately.

Step 2: Update PHP on Ubuntu / Debian

For servers using standard repositories or the Ondřej Surý PPA:

# Update package lists
sudo apt update

# Upgrade PHP core packages
sudo apt --only-upgrade install \
  php8.4 php8.4-cli php8.4-fpm php8.4-common php8.4-mysql php8.4-xml php8.4-curl

# Gracefully reload the PHP-FPM service
sudo systemctl reload php8.4-fpm

# Verify the service is running
sudo systemctl status php8.4-fpm

(Replace 8.4 with your active version: 8.3 or 8.2.)

Step 3: Update PHP on RHEL, AlmaLinux, or Rocky Linux

For servers running RHEL-based distributions with the Remi repository:

# Check available updates
sudo dnf check-update

# Upgrade PHP packages
sudo dnf upgrade php\*

# Restart PHP-FPM
sudo systemctl restart php-fpm

# Verify running version
php -v

Step 4: Update Docker containers

If your application runs in Docker containers:

1. Update your Dockerfile or docker-compose.yml base image tag to the safe patch release (for example, php:8.4.27-fpm-alpine).
2. Rebuild and restart the container fleet:

docker compose pull
docker compose up -d --force-recreate

3. Confirm the container runs the patched binary:

docker compose exec app php -v

Step 5: Essential hardening steps after updating

Patching the binary fixes the vulnerability, but every production PHP server should enforce three basic hardening rules:

1. Disable dangerous PHP functions: In your php.ini, ensure dangerous system execution functions are disabled:

   disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source

2. Prevent code execution in upload folders: If you run WordPress or custom upload systems, configure your Nginx or Apache server to block execution of .php files inside /wp-content/uploads/ or /storage/.
3. Lock down file permissions: Keep core website files read-only by the web server process. The web user should never have write access to executable PHP files.

The risk of unmanaged hosting

Most companies host their websites on unmanaged cloud servers (AWS EC2, DigitalOcean droplets, or generic VPS providers).

Unmanaged hosting providers do not patch your server software. When a zero-day vulnerability drops on a weekend or late at night, your server remains completely exposed until someone on your team notices, reads the advisory, and runs the updates manually.

This is why businesses get hacked: not because a patch didn’t exist, but because nobody patched their server in time.

Protect your infrastructure with FixrWeb

FixrWeb is a dedicated web development and cloud infrastructure studio. We do not use ticket queues, junior support agents, or automated generic hosting.

When you host or maintain your platform with FixrWeb:

• Direct Senior Engineers: Your servers are configured and guarded directly by senior systems engineers.
• 10-Minute Zero-Day Defense: When critical security bulletins are published, our automated pipelines and engineers deploy edge defenses and rolling binary updates immediately.
• 100% Client Code Ownership: You own all source code and infrastructure configurations in private repositories with zero vendor lock-in.
• 100% Uptime SLA: Zero-downtime rolling deployments mean your site stays fast and online during every security update.

If you want peace of mind knowing your servers are hardened, audited, and protected against zero-day threats:

Get a Free Server Audit & Security Quote or email our engineering team directly to secure your platform.