1. What Is a PHP CVE?

CVE stands for Common Vulnerabilities and Exposures. It is a system for identifying publicly disclosed cybersecurity vulnerabilities.

A PHP vulnerability is a security weakness in the PHP interpreter, its bundled components, or the way an application uses PHP. Depending on the vulnerability, an attacker might cause a denial of service, access sensitive data, or execute unauthorized code.

The vulnerabilities covered in this article affect PHP runtime internals. Consequently, even an application that follows good coding practices may be at risk if it runs on an affected PHP installation.

2. Understanding the Two PHP Vulnerabilities

CVE-2026-109618: Remote Code Execution Through Out-of-Memory Corruption

This issue involves PHP handling a memory allocation failure while internal request data is only partially initialized. During cleanup, PHP may incorrectly treat invalid internal data as valid.

Under the relevant conditions, an attacker may be able to exploit this behavior to execute code remotely. The precise exploitability depends on the runtime and execution environment.

CVE-2026-109619: Remote Code Execution Through Stale Internal State

This issue involves request-owned internal state that can remain referenced after its backing memory has been freed. A later request handled by the same worker may encounter the stale state before normal initialization resets it.

Under certain conditions, this behavior can also lead to remote code execution.

3. Affected and Fixed PHP Versions

The PHP project published security releases on October 21, 2026. The following releases fix both vulnerabilities in their respective branches.

PHP 8.1 and earlier no longer receive normal upstream security updates. Some operating-system vendors and long-term support providers may supply backported fixes. Check the specific vendor package before deciding whether an installation is patched.

You do not need to upgrade to PHP 8.5 solely to fix these two vulnerabilities. For example, a compatible application running PHP 8.3 can use PHP 8.3.36 or a later patched release in that branch.

PHP 8.2 reaches upstream end of life on December 31, 2026. If you use PHP 8.2, plan an upgrade to a supported branch as well as applying the immediate security fix.

Official source: PHP security advisory and fixed releases .

4. What Happens If You Don't Update PHP?

A vulnerable PHP installation is not automatically compromised. However, if an attacker successfully exploits a weakness, the impact can be severe.

• Remote code execution: Malicious commands may run with the privileges of the affected PHP process.
• Sensitive information exposure: Data accessible to the compromised process may be at risk.
• Website modification: Attackers may attempt to alter application files or introduce malicious content.
• Credential exposure: Database credentials, API keys, and other secrets may be at risk if the process can access them.
• Further compromise: An attacker may attempt to exploit other weaknesses in the server or connected systems.

The actual impact depends on server configuration, runtime permissions, network exposure, and other security controls.

The best response is to apply the security update promptly, then investigate suspicious activity if the system was exposed while vulnerable.

5. Does This Affect Laravel Applications?

Yes. Laravel applications can be affected when they run on a vulnerable PHP runtime.

Laravel is a PHP framework. Your routes, controllers, middleware, Eloquent models, and business logic all execute using PHP. Updating Laravel alone does not patch a vulnerability inside the PHP interpreter.

For example, imagine this environment:

• Framework: Laravel
• Runtime: PHP 8.3.35
• Database: MySQL
• Server: Linux with PHP-FPM

If the PHP installation is affected, updating Laravel packages alone will not resolve the runtime vulnerability. You need to update PHP to the appropriate patched release and restart or redeploy the affected workers.

6. How to Check Your PHP Version

Open a terminal or command prompt and run:

php -v

Example output:

PHP 8.3.36 (cli)
Copyright (c) The PHP Group

If your actual web application uses PHP 8.3.36, that runtime has the fixed PHP 8.3 release for these two CVEs.

However, the PHP version in your terminal may differ from the version used by Apache, PHP-FPM, a hosting control panel, or a Docker container.

Verify the version in the environment that actually handles web requests. Avoid creating a publicly accessible PHP information page because it can disclose sensitive server configuration. If you use a temporary diagnostic page, restrict access and remove it immediately.

7. How to Fix the PHP Security Vulnerability

Step 1: Back Up Your Application

Back up your application code, database, and important configuration before performing a production upgrade. Use your organization's normal deployment and rollback process.

Step 2: Check Compatibility

Review the PHP requirements for your Laravel version and third-party packages. Confirm that the patched PHP release is compatible with your application and installed extensions.

Step 3: Install a Patched PHP Release

Select the fixed version for your PHP branch. Use your operating system package manager, hosting control panel, or approved runtime-management process.

Official downloads: Download PHP .

Step 4: Restart or Redeploy

Restart the relevant PHP-FPM service, reload the appropriate web server when necessary, or rebuild and redeploy the application container. Follow the instructions for your operating system and deployment architecture.

Step 5: Verify the Runtime

php -v

Verify both the command-line version and the version used by your actual web application. Then test important functionality such as authentication, API endpoints, database connectivity, queues, scheduled jobs, and file uploads.

Step 6: Check Dependencies

composer audit

This command checks Composer-managed packages against known security advisories. It does not update PHP and does not replace the PHP runtime security patch.

8. What If Your Laravel Application Uses Docker?

If PHP runs inside a Docker container, updating PHP on your host machine does not automatically update the runtime inside that container.

Check the running PHP service. Replace app with the actual service name in your Compose file.

docker compose exec app php -v

Update the PHP base image to a patched release compatible with your application. Rebuild and redeploy the image, restart the relevant services, and verify the version inside the running container.

Do not assume that rebuilding an old image tag automatically downloads a patched PHP release. Use a verified patched image and follow your normal image update process.

What If You Use cPanel or Shared Hosting?

1. Open the hosting control panel.
2. Check the PHP version assigned to your domain.
3. Select a compatible patched version if available.
4. Contact your hosting provider if the fixed release is unavailable.
5. Verify the running website after the update.

The command-line PHP version and the PHP version assigned to your hosted website may differ.

9. Does Composer Update PHP?

No. Composer manages PHP application dependencies. It does not replace the PHP runtime installed on your server.

For example:

composer audit

This checks installed packages for known security advisories. It does not patch the PHP interpreter. Likewise, running composer update alone is not a fix for these PHP runtime vulnerabilities.

Update the runtime using the appropriate system or hosting process, and maintain Composer dependencies as a separate security task.

10. PHP and Laravel Security Checklist

Use this checklist to review your deployment:

• Identify the PHP version used by each production application.
• Verify that the PHP runtime is patched or has an applicable vendor backport.
• Update vulnerable PHP installations promptly.
• Restart services or redeploy containers after the update.
• Verify the PHP version used by the web server, not only the CLI.
• Run Composer security audits.
• Keep Laravel and third-party packages supported and patched.
• Protect environment files, API keys, and database credentials.
• Review logs if a previously vulnerable server was exposed.
• Plan upgrades away from end-of-life PHP branches.

11. Frequently Asked Questions

12. Official References

• Official PHP security advisory — October 21, 2026
• PHP 8.3.36 release announcement
• Official PHP downloads
• Composer audit documentation

Conclusion

CVE-2026-109618 and CVE-2026-109619 highlight why maintaining the PHP runtime is an essential part of application security.

Laravel developers should remember that secure application code does not eliminate vulnerabilities in the underlying runtime.

Check your PHP version, install the appropriate patched release, restart or redeploy the application, and verify that the web server is using the updated runtime.

Found this guide helpful? Share it with other PHP and Laravel developers, and follow Codementix for more programming tutorials and security updates.