The PHP development team has released emergency security updates to fix two critical vulnerabilities that could allow attackers to execute malicious code on servers without logging in.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carry a severity score of 9.2 out of 10. The PHP team is urging developers and businesses to update immediately, warning that there is no complete workaround for either issue.

For companies running Laravel applications, this needs immediate attention.

The problem is not with Laravel itself. It exists in PHP, the language running underneath the framework. This means an application could have properly secured routes, authentication and other safeguards but still be exposed through its PHP runtime.

What Exactly Is the Problem?

The two vulnerabilities affect how PHP manages memory and handles requests.

CVE-2026-109618 (Out-of-Memory Corruption): An error during memory allocation can leave PHP's internal request data in an invalid state. Under certain conditions, an attacker can exploit this to execute code on the server.

CVE-2026-109619 (Stale Global State): PHP can retain references to memory that has already been freed. When another request accesses that memory, it can create an opportunity for remote code execution.

The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

According to the PHP security announcement, the risk is particularly serious for Apache with mod_php, where researchers demonstrated an attack that could be triggered before any application code runs.

That is why updating your Laravel application alone will not resolve the issue. The PHP runtime itself needs to be patched.

Which PHP Versions Are Safe?

The PHP team has released fixes in the following versions:

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

If your server runs an earlier release within any of these version branches, update to the corresponding patched version.

PHP 8.1 and older no longer receive official security updates from the PHP project. Some Linux distributions and long-term support vendors may provide backported fixes, so check with your provider or plan an upgrade to a supported version.

The updated releases are available on the official PHP downloads page.

Why This Matters Beyond Laravel

This incident is a reminder that application security goes beyond the code your developers write.

A well-built application can still be exposed through an outdated runtime, server configuration or dependency. For companies running customer-facing products, payment systems and business applications, leaving critical infrastructure unpatched creates risks that cannot be addressed through application-level security alone.

If your engineering team manages PHP applications, make this update a priority today. Confirm which servers are affected, apply the available patches and check that your production services are running correctly afterwards.

The PHP team has been clear that configuration changes may reduce exposure to certain attack methods, but they are not complete fixes.

The safest action is to update now, rather than wait for an incident to reveal which systems were vulnerable.

This is a developing security story. Information reflects official PHP and Laravel announcements as of October 21, 2026.