Critical PHP Vulnerabilities in October 2026: How to Secure PHP-FPM on Linux Servers

Linux Critical PHP Vulnerabilities in October 2026: How to Secure PHP-FPM on Linux Servers
Linux PHP Security

Critical PHP Vulnerabilities in October 2026: How to Secure PHP-FPM on Linux Servers

October 26, 2026

Introduction

PHP administrators need to pay attention to two critical security vulnerabilities disclosed in October 2026. These vulnerabilities could allow remote attackers to execute arbitrary code on vulnerable PHP installations under suitable conditions.

The PHP development team released security updates on October 21, 2026, addressing the following vulnerabilities:

  • CVE-2026-109618: Remote code execution associated with incorrect handling of out-of-memory conditions.
  • CVE-2026-109619: Remote code execution associated with stale internal request state when PHP workers are reused.

Both vulnerabilities have been rated critical. PHP installations serving web requests are potentially affected, including PHP-FPM, Apache mod_php, CGI-based deployments, and other PHP server configurations.

For production Linux servers hosting WordPress, Laravel, and other PHP applications, updating the PHP runtime should be a priority.

1. Which PHP Versions Have Been Patched?

The PHP project released the following upstream versions containing fixes for these vulnerabilities.

PHP Branch Fixed Upstream Version
PHP 8.2 8.2.35
PHP 8.3 8.3.36
PHP 8.4 8.4.27
PHP 8.5 8.5.12

These are the upstream PHP release numbers. Linux distributions may provide security fixes through their own package versions, including backported patches. Therefore, administrators should check their distribution’s security advisory and installed package versions rather than relying exclusively on the upstream version number.

Important: PHP 8.2 is approaching its scheduled end of security support on December 31, 2026. Administrators using this branch should plan an upgrade to a supported PHP version.

2. Check the Installed PHP Versions

Before applying updates, identify the PHP versions installed on your server.

On Debian or Ubuntu, run:

cat /etc/os-release

Check the default PHP CLI version:

php -v

If multiple PHP versions are installed, check each one:

php8.2 -v
php8.3 -v
php8.4 -v

Commands for versions that are not installed will return an error.

Next, identify installed PHP-FPM packages:

dpkg -l | grep -E 'php[0-9]+\.[0-9]+-fpm'

Check which FPM services are running:

systemctl --type=service --state=running | grep php

You can also inspect installed PHP packages:

dpkg -l | grep -E 'php[0-9]+\.[0-9]+-(cli|common|fpm|opcache)'

These commands help establish which PHP versions and components require attention.

Remember that the default php -v command reports the CLI version. It does not, by itself, confirm the version serving your websites through PHP-FPM.

3. Update PHP-FPM on Debian and Ubuntu

The update procedure depends on the Linux distribution and the repository used to install PHP.

Step 1: Refresh the package lists

Run:

apt update

Check whether PHP packages have available updates:

apt list --upgradable 2>/dev/null | grep -E 'php[0-9]+\.[0-9]+'

Review the available package versions before proceeding.

Step 2: Check the candidate package version

For PHP 8.3, for example:

apt-cache policy php8.3-fpm php8.3-cli php8.3-common

Repeat the command for each installed PHP branch.

For example:

apt-cache policy php8.2-fpm php8.4-fpm

Check that the candidate versions include the required security fixes according to your distribution’s advisory.

Step 3: Upgrade the installed PHP packages

On a server using Debian or Ubuntu packages, you can upgrade the relevant installed PHP components.

For PHP 8.3:

apt install --only-upgrade \
  php8.3-cli \
  php8.3-common \
  php8.3-fpm \
  php8.3-opcache

For PHP 8.4:

apt install --only-upgrade \
  php8.4-cli \
  php8.4-common \
  php8.4-fpm \
  php8.4-opcache

For PHP 8.2:

apt install --only-upgrade \
  php8.2-cli \
  php8.2-common \
  php8.2-fpm \
  php8.2-opcache

Important: These commands upgrade packages only when an eligible update is available from the configured repositories. They do not guarantee that the required security fix is available.

If a package is not installed, APT may report that it cannot be upgraded. Remove package names that do not apply to your installation.

Also, do not blindly copy the upstream version numbers into package installation commands. Debian, Ubuntu, and third-party repositories may use different package versioning schemes.

If the required update is unavailable, investigate the appropriate vendor security repository or advisory before proceeding.

Step 4: Review configuration changes

During package upgrades, you may be asked whether to replace an existing configuration file, such as php.ini.

For production servers, review the differences before making a decision.

Preserving the current configuration can help avoid unexpected changes to application settings, but it must not be treated as a substitute for reviewing the new configuration and security recommendations.

Before updating, maintain a backup of important PHP configuration files and ensure that a recent server or application backup is available.

4. Restart PHP-FPM and Verify the Update

After upgrading PHP, verify that the relevant services have loaded the updated runtime.

For PHP 8.3:

systemctl restart php8.3-fpm
systemctl status php8.3-fpm --no-pager

For PHP 8.4:

systemctl restart php8.4-fpm
systemctl status php8.4-fpm --no-pager

For PHP 8.2:

systemctl restart php8.2-fpm
systemctl status php8.2-fpm --no-pager

Run these commands only for PHP-FPM services that are installed and used by your websites.

Inspect the service logs if the service fails to start:

journalctl -u php8.3-fpm -n 100 --no-pager

Replace php8.3-fpm with the relevant service name.

Check the installed CLI version again:

php8.3 -v

Also verify the package version:

dpkg-query -W php8.3-fpm

The package version should be checked against the security fix provided by your distribution.

A successful CLI version check alone is not sufficient. Confirm that the FPM service has restarted successfully and that your web applications are operating correctly.

5. Verify That Websites Are Using the Updated PHP Runtime

Servers hosting multiple websites may have several PHP versions installed simultaneously.

For example, one WordPress website may use PHP 8.2, while another application uses PHP 8.3 or PHP 8.4.

Consequently, updating one PHP branch does not automatically update every website.

Verify the PHP version configured for each website through your hosting control panel or web-server configuration.

Test the following after patching:

  • WordPress administration and the public website.
  • Laravel applications and API endpoints.
  • Database connectivity.
  • Login and authentication functionality.
  • File uploads and form submissions.
  • Scheduled jobs and background tasks.
  • PHP-FPM service health and error logs.

If you use a temporary PHP diagnostic script to verify the web-facing version, restrict access to it and remove it immediately after testing. Do not leave a publicly accessible phpinfo() page on a production server.

6. What About PHP 7.3 and PHP 7.4?

Older PHP installations require additional attention.

PHP 7.3 and PHP 7.4 are no longer supported by the upstream PHP project. They do not receive routine upstream security releases.

If you operate older applications that depend on these versions, check whether your operating system vendor provides maintained packages containing the relevant security fixes.

Some vendors may backport security patches, so the upstream PHP version number alone is not sufficient to determine whether a particular package is patched.

For legacy applications, the preferred long-term approach is to migrate to a supported PHP branch after testing application compatibility.

If an immediate upgrade is not possible:

  1. Determine whether the installed PHP package is covered by a vendor security-maintenance program.
  2. Check the vendor’s advisory for both CVEs.
  3. Apply any vendor-provided security update.
  4. Restrict public exposure where practical.
  5. Plan an application migration to a supported PHP version.

Do not assume that a PHP 7.3 or 7.4 installation is secure simply because it continues to run without errors.

7. Can Disabling Session Upload Progress Fix These Vulnerabilities?

One setting administrators may encounter during mitigation is:

session.upload_progress.enabled = Off

This disables PHP’s session upload-progress feature.

However, it is important to distinguish a mitigation from a complete security fix.

Disabling this setting may reduce exposure to a particular attack path associated with session handling, but it does not address every vulnerability described in this advisory.

The PHP project recommends installing the security updates rather than relying on configuration changes alone.

If you apply a mitigation, make sure it is configured for the relevant PHP-FPM pools and that the setting is actually active in the web-facing PHP runtime.

Verify the configuration using the appropriate administrative methods, and restart the affected services when required.

8. Additional Security Recommendations for PHP-FPM Servers

Patching the PHP runtime is the first priority. Administrators should also review the overall security of their hosting environment.

Recommended measures include:

  • Keep the operating system and installed packages updated.
  • Remove unsupported PHP versions where they are no longer required.
  • Restrict administrative access to trusted IP addresses or a VPN.
  • Use a web application firewall where appropriate.
  • Configure rate limiting and request-size limits at the web-server or reverse-proxy layer.
  • Ensure that PHP-FPM pools run with appropriate user permissions.
  • Avoid exposing PHP-FPM listening ports directly to the public internet.
  • Keep WordPress, plugins, themes, and Composer dependencies updated.
  • Monitor PHP-FPM logs and web-server access logs.
  • Maintain regular, restorable backups.
  • Test updates on a staging environment when possible.

A web application firewall can help reduce exposure to certain malicious requests, but it should not be considered a replacement for updating vulnerable PHP packages.

9. Special Considerations for HestiaCP and VestaCP

Hosting control panels often manage multiple PHP-FPM versions and website-specific PHP configurations.

Before applying updates, identify which PHP versions are installed and which versions are assigned to each domain.

For HestiaCP or VestaCP environments, consider the following:

  1. Back up the relevant configuration files.
  2. Review the package versions available from the configured repositories.
  3. Confirm that the required PHP-FPM security updates are available.
  4. Upgrade the installed packages using the appropriate package manager.
  5. Verify that the PHP-FPM services start successfully.
  6. Test a selection of websites running each affected PHP version.
  7. Review service logs and investigate any failures.

Avoid manually replacing PHP binaries or changing hosting-panel templates unless you understand how the panel manages those components.

For production hosting environments, package updates should be performed carefully to minimise the risk of downtime across multiple customer websites.

10. Final Checklist

Use this checklist when patching a Linux server running PHP-FPM.

  • Identify the operating system and repository configuration.
  • List all installed PHP versions.
  • Identify the PHP-FPM services in use.
  • Check the security advisory for each installed PHP branch.
  • Back up relevant configurations.
  • Install the required security updates.
  • Restart the affected PHP-FPM services.
  • Verify the installed package versions.
  • Confirm that the FPM services are healthy.
  • Test websites using each affected PHP version.
  • Review application and service logs.
  • Plan the migration of unsupported PHP installations.

Conclusion

The October 2026 PHP security updates highlight why regular runtime maintenance is essential for Linux server administrators.

A vulnerable PHP runtime can expose web applications to serious risks, regardless of whether those applications use WordPress, Laravel, or custom PHP code.

Administrators should identify every affected PHP installation, apply the appropriate security updates from trusted repositories, restart the relevant PHP-FPM services, and verify the results.

For production servers hosting multiple websites, a careful and systematic patching process helps improve security while reducing the risk of service disruption.

Security references

Always consult the relevant operating-system vendor’s advisory before deciding whether a particular package is patched.