Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.
In this guide
Key takeaways
- PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the patches for CVE - 2026 - 109618 and CVE - 2026 - 109619.
- Upgrade immediately or apply the official back - ports if you cannot upgrade.
- Verify the patch by checking the PHP changelog or running
php -von your servers.
Are the critical PHP remote - code - execution flaws fixed?
Yes. The two remote - code - execution (RCE) vulnerabilities identified as CVE - 2026 - 109618 and CVE - 2026 - 109619 have been fixed in the official PHP release series. The PHP security team published updated versions that include the necessary code changes.
Which PHP versions include the fix?
The fixes are shipped in the following stable releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35 These versions are the most recent point releases for each maintained branch and replace the vulnerable prior versions.
How to confirm your installation is patched
- Run
php -von the server. The output should show one of the patched version numbers listed above. - Review the official PHP changelog for the corresponding release; the entry will reference CVE - 2026 - 109618 and CVE - 2026 - 109619.
- Optionally, use a scanner (e.g., Decloak's free scan) that checks for known vulnerable JavaScript libraries and server - side misconfigurations; while Decloak does not test PHP binaries directly, it can confirm the server's HTTP/TLS posture after the upgrade.
What if I cannot upgrade immediately?
If you are locked to an older branch, consider applying the back - ported patches provided by your OS vendor. Many Linux distributions release security - updated packages that incorporate the upstream fixes without changing the version number. Verify the package version against the distribution's security advisory.
Should I test after upgrading?
After upgrading, run a regression test suite for your application to ensure compatibility. Additionally, perform a passive web security scan to confirm the server no longer exhibits the vulnerable behavior. If you have a paid Decloak plan, you can enable Active Testing to probe for any remaining RCE vectors safely.
Where to find the official announcement?
The PHP project posted a security announcement on their website, linking to the release notes for each patched version. Those documents list the CVE identifiers and describe the mitigations applied.
Summary
The critical PHP RCE bugs CVE - 2026 - 109618 and CVE - 2026 - 109619 are fixed in the latest point releases across all supported branches. Upgrade promptly, verify the version, and run post - upgrade scans to ensure your environment is secure.
Related guides
What are the most common PHP security vulnerabilities and how to fix them?
Learn the top PHP security flaws - XSS, SQL injection, CSRF, RCE, file inclusion, session hijacking, IDOR, unsafe uploads, weak cryptography, and code injection - and get concrete steps to mitigate each one.
What is PHP and Why Should Developers Care About Its Security?
PHP is a widely used server - side scripting language that powers many web applications, but its popularity also makes it a frequent target for attackers.
How to Mitigate the New PHP RCE Vulnerability CVE - 2026 - 115560
Disable the session upload - progress feature to protect against the newly disclosed PHP remote - code - execution flaw that triggers when the session serializer is changed at runtime.