Critical PHP security patches: Upsun rollout and what to check

PHP fixed two critical vulnerabilities on October 21, 2026. See the patched versions, how Upsun Cloud is rolling them out, and what to check in your projects.

Status (October 23, 2026):

• Edge protection: Web application firewall (WAF) rules on Upsun Cloud’s edge layer block known attack patterns against every site hosted on Upsun Cloud, patched or not. They’re a first line of defense: only a patched PHP version fixes the vulnerabilities.
• Patched images: Every php runtime image from PHP 7.2 to 8.5 is patched, and affected environments are redeployed, including all Dedicated clusters.
• Failed redeploys: Upsun Cloud is notifying each affected customer directly.
• PHP in the composable image: Patched PHP versions are rolled out for composable image version 26.05.

What to do:

• Notified that the patch couldn’t be applied: Your environment still runs a vulnerable PHP version. Fix the failed deployment now.
• PHP 8.4 or 8.5: Nothing. Your app runs a patched version.
• PHP 7.2 to 8.3: Your app is patched, but these versions are deprecated or retired. Upgrade to PHP 8.4 or later as soon as possible.
• PHP 7.1 or earlier: No patch exists. Upgrade now.
• PHP in composable image 26.05: Nothing. Your app runs a patched version.
• PHP in an earlier composable image version: Switch to version 26.05 to get the patch.

Follow the latest updates on the status page.

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These versions fix two critical vulnerabilities that can allow unauthenticated remote code execution (RCE). For details, see the PHP security advisory and the advance notice on php.net. Before the release, Upsun Cloud deployed WAF rules at its edge layer to block known attack patterns. These rules remain in place for every site hosted on Upsun Cloud, patched or not. They’re a first line of defense: only a patched PHP version fixes the vulnerabilities. Since the release, Upsun Cloud has rolled out patched PHP images and redeployed affected environments. If a redeploy failed because of an issue in an app, Upsun Cloud is notifying the customer directly.

​

Update history

• October 23, 2026, 03:54 UTC: Upsun Cloud finished rolling out patched PHP versions for apps that run PHP in composable image version 26.05.
• October 22, 2026: Upsun Cloud rolled out patched images for PHP 7.2 and 7.3.
• October 22, 2026: Upsun Cloud started notifying customers whose environments couldn’t be redeployed automatically because of an issue in their app’s code or configuration.
• October 22, 2026: Upsun Cloud contacted customers who run PHP on the composable image or on PHP 7.3 or earlier.
• October 22, 2026, 04:12 UTC: Upsun Cloud finished deploying the patch to all Dedicated clusters.
• October 21, 2026, 23:35 UTC: Upsun Cloud finished rolling out patched images for PHP 7.4 to 8.5, including backported fixes for 7.4, 8.0, and 8.1. The composable image update is still in progress.
• October 21, 2026, 16:00 UTC: First published.
• October 21, 2026, before the PHP release: Upsun Cloud deployed WAF rules and other mitigations on its edge layer to block known attack patterns. They remain in place for every site hosted on Upsun Cloud, patched or not.

​

What was fixed

The release addresses two vulnerabilities, both rated 9.2 (critical) on the CVSS v4.0 scale. CVSS (Common Vulnerability Scoring System) rates the severity of vulnerabilities from 0 to 10, and scores of 9.0 or above are critical.

CVE	Description	CVSS v4.0
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)	RCE via out-of-memory (OOM) corruption. OOM handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid.	9.2
CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)	RCE via stale global state. Request-owned internal state can survive after its memory is freed, and a later request handled by the same worker may use it.	9.2

The researchers who discovered the vulnerabilities call the pair “PHP2Shell”. For their overview, see php2shell.com.

According to the PHP project, every PHP installation that serves web requests is at risk. This includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

​

How the vulnerabilities work

Both vulnerabilities are memory-safety bugs in PHP itself, not in application code. Your app can be affected even if its own code is secure.

• CVE-2026-109618: When PHP runs out of memory, it jumps straight out of the current operation. During request startup, for example while PHP parses the request body, some request memory is reachable before it’s fully initialized. If memory runs out at that moment, PHP’s cleanup code later treats the half-initialized data as valid. The fix replaces the immediate jump with a graceful out-of-memory error at a safe point.
• CVE-2026-109619: PHP workers handle many requests in a row and keep some global state between them. If a request ends abruptly, for example with a fatal error, that state can still point to memory that’s already been freed. Some operations at the start of the next request read this stale state before PHP resets it. The fix resets all global state before those operations run.

The researchers used WordPress, Drupal, and Joomla to demonstrate the attacks, and apps built on them are affected like any other PHP app. Because the flaw is in PHP, updating your CMS, framework, or plugins doesn’t fix it: only a patched PHP version does.

The GitHub advisories linked in the table have the full technical details.

​

Affected and patched versions

The following table maps each PHP branch to its patched version on Upsun Cloud:

PHP branch	Status on Upsun Cloud	Last vulnerable version	Patched version
8.5	Supported	8.5.11	8.5.12
8.4	Supported	8.4.26	8.4.27
8.3	Deprecated	8.3.35	8.3.36
8.2	Deprecated	8.2.34	8.2.35
8.1	Retired	8.1.34	Backported fixes, image php:8.1 :1424
8.0	Retired	8.0.30	Backported fixes, image php:8.0 :1628
7.4	Retired	7.4.33	Backported fixes, image php:7.4 :1548
7.3	Retired	7.3.33	Backported fixes, image php:7.3 :1681
7.2	Retired	7.2.34	Backported fixes, image php:7.2 :1782

The PHP project released official patched versions for PHP 8.2 through 8.5. For PHP 7.2 to 8.1, there’s no new upstream release: Upsun Cloud’s patched images apply backported fixes to the last release of each branch. Upsun Cloud has rolled out patched images for every version in this table.

​

Check your PHP version

How you check depends on your PHP version.

PHP 8.2 to 8.5: The PHP project released new version numbers, so check the PHP version:

  upsun ssh --environment main --app myapp -- php -v

Replace main with your environment name and myapp with your app name. If your project has a single app, you can omit --app. The output should show the patched version from the table above, for example PHP 8.4.27.

PHP 7.2 to 8.1: The fixes are backports without a new version number, so php -v still shows the old version. Check the image instead:

  upsun app:config-get --property type --project abcdefgh1234567 --environment main

Replace abcdefgh1234567 with your project ID and main with your environment name. The output should show the patched image from the table above, for example php:8.1 :1424.

If your app still shows a vulnerable version, its last deployment might have failed. See If the automatic redeploy failed. If the deployment succeeded, contact Upsun Cloud support.

​

Retired PHP versions

PHP 8.1 and earlier are end of life and retired on Upsun Cloud.

• PHP 7.4, 8.0, and 8.1: The PHP project no longer releases new versions, but its security team published source backports. Upsun Cloud’s patched images for these versions are based on those backports.
• PHP 7.2 and 7.3: No official backports exist, but Upsun Cloud went further and rolled out patched images for these versions too.
• PHP 7.1 and earlier: No fix exists for these vulnerabilities. The only fix is to upgrade to a supported PHP version. Upsun Cloud has contacted every customer who runs these versions.

​

What you need to do

If your app uses a php runtime image on PHP 7.2 or later, or runs PHP in composable image version 26.05, Upsun Cloud has updated it with a patched version. You don’t need to do anything to get the patch, unless Upsun Cloud notified you that the redeploy failed. To confirm, check your PHP version.

Take action if any of the following applies to you:

• Upsun Cloud notified you that the patch couldn’t be applied: Fix the failed deployment.
• Your app runs PHP 8.3 or earlier: Upgrade to a supported PHP version.
• Your app runs PHP in a composable image version earlier than 26.05: Switch to version 26.05.

​

If the automatic redeploy failed

For some environments, the automatic redeploy failed because of an issue in the app’s code or configuration, such as a failing build or deploy hook. These environments still run a vulnerable PHP version. Upsun Cloud didn’t change their code or configuration and is notifying the affected customers directly.

To get the patched version:

1. Find the error in the log of the latest failed activity, in the Console or with the CLI:

     upsun activity:list --environment main
     upsun activity:log ACTIVITY_ID
   

   Replace main with your environment name and ACTIVITY_ID with the ID of the failed activity.

2. Fix the error in your code or configuration, and then push the change. The new deployment uses the patched PHP image.

3. Check your PHP version.

For help, reply to the notification or contact Upsun Cloud support.

​

Upgrade to a supported PHP version

Running PHP 8.3 or earlier? Upgrade to PHP 8.4 or later as soon as possible. PHP 8.2 and 8.3 are deprecated on Upsun Cloud, and PHP 8.1 and earlier are retired. Future security fixes might not reach these versions, and PHP 7.1 and earlier have no fix for these vulnerabilities at all.

To upgrade, change the type of your app in your configuration file. This example uses PHP 8.5, the latest version:

  applications:
    myapp:
      type: "php:8.5"

Push the change to a preview environment, test it against a copy of your production data, and then merge.

If you need help, contact Upsun Cloud support. If you received Upsun Cloud’s urgent notification about this upgrade, you can also reply to it.

​

Optional: disable session upload progress

For an extra layer of protection, disable the session.upload_progress.enabled PHP setting. According to the PHP project, this blocks the confirmed session-based attack paths for CVE-2026-109619, but not other variants. It reduces exposure but doesn’t replace the patched versions.

This setting is rarely needed: it only powers upload progress bars that rely on PHP sessions.

To apply it across all environments in your project, use the Upsun CLI:

  upsun variable:create --level project --name php:session.upload_progress.enabled --value "Off"

Project variables take effect after a redeploy.

Alternatively, set it in a custom php.ini file at your app root:

  session.upload_progress.enabled = Off

Don’t use ini_set() or a .user.ini file for this setting. They apply too late in the request to block the attack.

If your app runs PHP 8.5, also set fatal_error_backtraces to Off the same way, for example:

  upsun variable:create --level project --name php:fatal_error_backtraces --value "Off"

This blocks the confirmed fatal error backtrace path only.

For more information, see how to customize PHP settings. For the complete list of interim measures, see the PHP security advisory.

​

If you run PHP in the composable image

In the composable image, PHP comes from the image version set in your configuration. Upsun Cloud rolled out the patched PHP versions for composable image version 26.05 on October 23, 2026.

• Version 26.05: You don’t need to do anything. To confirm, check your PHP version with php -v.
• Earlier versions: They don’t get the patched PHP versions. Switch to version 26.05.

To switch, change the type of your app in your configuration file:

  applications:
    myapp:
      type: "composable:26.05"

Push the change to a preview environment, test it, and then merge.

​

Outside Upsun Cloud

Upgrade PHP to the patched versions anywhere else you run it, including:

• Local development machines
• Docker images
• CI pipelines

Linux distributions and long-term support (LTS) vendors received the patches in advance, so check your vendor for updated packages. If you install PHP from rpms.remirepo.net, the PHP project recommends switching to distribution packages or building from source. That repository didn’t have updates on the release day.

​

How Upsun Cloud responded

Upsun Cloud was aware of the vulnerabilities before the public announcement. Its response had three parts: protection at the edge, patched PHP images, and direct outreach for the cases a standard rollout doesn’t cover.

​

Before the release: mitigation at the edge

The edge is the network layer that handles traffic before it reaches your app. Upsun Cloud’s edge layer sits in front of every cluster and site.

Before the PHP release, Upsun Cloud deployed WAF rules and other mitigations on this layer. They block known attack patterns against every site hosted on Upsun Cloud, patched or not. This works as a virtual patch: it reduces exposure until PHP itself is patched. The rules remain in place as an extra layer of protection on top of the patched PHP images.

Some projects also route traffic through a CDN such as Fastly. Self-service projects don’t include a CDN by default. Where a CDN is in place, its own mitigations add further protection.

​

After the release: patched PHP images

As soon as the PHP project published the patched versions, Upsun Cloud built patched PHP images. Images for PHP 8.2 and later came first, because the PHP project released official versions for them. Images for PHP 7.4, 8.0, and 8.1 followed, based on the PHP project’s source backports. Images for PHP 7.2 and 7.3 followed on October 22, 2026.

Upsun Cloud then automatically redeployed every environment that uses a php runtime image, project by project and region by region. Each site went offline briefly while its environment redeployed. The redeploy didn’t change any code or configuration. If an app’s build or deploy failed, the environment kept running its previous PHP version.

The rollout of patched images is complete, including all Dedicated clusters, and Upsun Cloud continues to monitor the platform.

​

Beyond the standard rollout

Upsun Cloud also covered the cases that a standard rollout leaves out:

• Versions PHP no longer supports: Upsun Cloud rolled out patched images for PHP 7.2 to 8.1. Customers on these versions got the fix without having to upgrade.
• Versions too old to fix (PHP 7.1 and earlier): Upsun Cloud contacted every affected customer directly, so no one had to find out from the status page.
• Environments where the automatic redeploy failed: Upsun Cloud is notifying these customers directly.
• Every site, patched or not: The WAF rules on the edge layer remain in place and block known attack patterns. They’re a first line of defense, not a fix: if your app still runs a vulnerable PHP version, fix or upgrade as soon as you can.

​

Acknowledgments

Upsun Cloud thanks the researchers who discovered and responsibly disclosed these vulnerabilities:

• Wiz Research: Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz
• OpenAI Codex Security: Amy Burnett
• Calif: Ryan A.

Thanks also to the PHP security team for coordinating the disclosure and shipping fixes, including backports for end-of-life versions, and to the industry partners who helped prepare mitigations and guidance.

​

Questions

If you have questions about your project, contact Upsun Cloud support.