Check PHP deployments for the October security fixes

The PHP team says CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution. Its advisory covers PHP installations serving web requests, with the highest stated risk for Apache mod_php. ^[1]

Read the command-line version

The PHP manual documents the version option. ^[2]

bash

php -v

You should see the version of the PHP executable on your command path. ^[2] Check your hosting panel or service configuration separately to identify the web runtime.

Compare the deployment with its vendor notice

The upstream fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution vendors may backport fixes without using those version numbers. The PHP team directs those users to their vendor's updated packages. ^[1]

Warning: replacing a runtime can affect application compatibility. Follow your vendor's update procedure and check your application before resuming normal traffic.

Review the follow-up advisory

The October 23 notice recommends disabling session upload progress for an unusual serialization-handler combination until its fix. Read that notice against your configuration, even after applying the October 21 updates. ^[1]

Record the package installed and the web service running it, so the next check compares the deployment that actually serves requests.