OFFICIAL PATCHES / PRACTICAL GUIDANCE

Get the right fix.
Use the trusted source.

For individuals, businesses and charities: choose who manages PHP, open the official update source and use the preparation checklist.

Published 22 October 2026 · Sources checked 22 October 2026 · Next review due 29 October 2026

SHARED / MANAGED HOSTING

My host manages PHP

Use your authenticated hosting panel or contact the provider. Ask for a build that fixes both CVEs, confirmation of the running web PHP and replacement of old workers.

A WordPress, plugin or theme update alone does not replace the PHP runtime update.

Copy the request for your host →

WINDOWS ADMINISTRATORS

Official Windows builds

Open PHP’s official Windows downloads. Match the branch, architecture, thread-safety build, extensions and requirements to the actual IIS or Apache installation.

Back up configuration, test first and follow the official installation instructions.

Open official Windows downloads →

LINUX / VPS ADMINISTRATORS

Use your vendor packages

Use the established signed package source for your OS release. A vendor may backport the fix under an older PHP number, so check the full revision for both CVEs.

Ubuntu update notice →Debian package status: first CVE →Debian package status: second CVE →

UPSTREAM / SOURCE BUILDS

Official PHP releases

For administrators maintaining an upstream installation or building PHP themselves, use PHP’s own downloads and instructions. Check published verification information for the chosen artifact.

Open official PHP downloads →

APPLIANCES / BUNDLED PHP

Check the product vendor

Ask the product vendor for its advisory and supported update. Do not replace bundled components independently without its instructions.

Work through the update checklist →

FREE / NO REGISTRATION

Take the guidance with you

Download the patch checklist, incident record, recovery checklist and continuity guide. Keep the evidence in your own protected records.

Open all free downloads →

Verified upstream fixes

Verified upstream fixes for both CVEs, as checked on 22 October 2026
PHP branch	Fixed release	PHP-project security support ends
8.2	8.2.35	2026-12-31
8.3	8.3.36	2027-12-31
8.4	8.4.27	2028-12-31
8.5	8.5.12	2029-12-31

These are the verified fixed releases for the two listed advisories, checked on 22 October 2026. Choose a currently supported fixed release that your application and provider support. If the official page now offers something newer, review its release information rather than treating this table as a live feed.

Sources: PHP official security announcement · PHP upstream support calendar.

Before you install

Identify the web runtime, hosting owner and installation source.
Preserve evidence if compromise is suspected; ask a qualified responder for help.
Verify backups and a restore route, then test compatibility in staging.
Apply the appropriate official/vendor update and replace affected running workers.
Recheck the runtime/package and validate the website’s important functions.

Use the guided update plan Download the patch checklist

A request you can send to your hosting provider

Select and copy this text into your existing support channel. Add only the account information your host needs; never include passwords or private keys.

Hello,

Please confirm whether the PHP runtime serving my website is affected by CVE-2026-109618 or CVE-2026-109619, and whether the fixes for both are installed.

Please provide the PHP build/package revision, the vendor advisory that confirms the fix, and confirmation that all affected workers were replaced. If an update is still needed, please confirm the maintenance plan, backup/restore arrangements and how website functionality will be checked.

Thank you.

Official download pages checked 22 October 2026: PHP downloads · Windows builds · Ubuntu notice (published 21 October 2026).