Fix the problem

Close the PHP vulnerabilities – step by step

Choose where your website runs. We’ll show you exactly what to do – or Denkcode will take care of it for you.

Choose your situation below under “All guides”.

Haven’t checked yet whether you’re affected? Run a quick check first

The goal: at least this version

PHP 8.2from 8.2.35
PHP 8.3from 8.3.36
PHP 8.4from 8.4.27
PHP 8.5from 8.5.12

Applies to CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older no longer receive updates – the only fix there is switching to a newer branch.

Before

Before you start

Create a backup: Back up your files and database – most providers offer a backup function in the customer area.
Note your current version: Find it with the verification file so you can compare before and after.
Staying on the same branch is easiest: An update from e.g. 8.3.20 to 8.3.36 only contains bug fixes. A branch change (e.g. 8.1 → 8.3) should be tested first.

For reference

All guides

Tap your situation. If you’re not sure: if you have a customer area with a hosting provider and no server access via SSH, it’s almost always “Web hosting plan”.

Shared web hostingHoster control panel, no dedicated server – the most common setup

In a shared hosting environment (e.g. 1blu, IONOS, Strato, All-Inkl, Hetzner, Netcup), the provider applies security patches. You only select the PHP branch.

Log in to your hosting provider's customer panel.
Open your hosting package and look for "PHP version" or "PHP settings" (often under "Domains" or "Settings").
Check which PHP version is configured there. If it shows 8.1 or older, choose PHP 8.3 or 8.4 and save. Otherwise stay on your branch – the provider applies patch updates.
Use the verification file to check whether a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) is running. If not: contact your provider (template below).

PleskPlesk control panel

Log in to Plesk → Websites & Domains → select your domain.
Click on "PHP" or "PHP Settings".
Under "PHP version", choose 8.3 (or newer), keep execution as "FPM application", click OK.
As server administrator additionally: Open Tools & Settings → Updates and install available PHP component updates (naming varies by Plesk version).
Use the verification file to confirm that a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) is running.

cPanelcPanel / WHM control panel

Log in to cPanel and open "MultiPHP Manager" – at some hosts it is called "Select PHP Version".
Check your domain, select PHP 8.3 (or newer) and click Apply.
The patch level is maintained by the hosting provider or server administrator (via system updates in WHM).
Use the verification file to check whether a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) is running. If not: contact provider (template below).

Dedicated server: Ubuntu or DebianSSH access, packages via apt

Example for PHP 8.3 – replace 8.3 with your branch. In your check result, the assistant fills in your version automatically.

Show installed PHP packages:

dpkg -l | grep -E '^ii +php[0-9.]+-(fpm|cli|common)'

Update package repositories and upgrade PHP packages of this branch:
```
sudo apt update && sudo apt install --only-upgrade 'php8.3*'
```

Restart PHP processes:

sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2   # or: sudo systemctl restart nginx

Check version:
```
php8.3 -v
```
The command line may differ – the verification file result is authoritative.
If the version remains below the fixed release (common with distribution packages), check if the fix was backported:
```
apt changelog php8.3-fpm | grep -E 'CVE-2026-10961[89]'
```
If both CVE IDs appear, the fix is included. Otherwise obtain packages from an up-to-date repository (e.g. Ondřej Surý) or ask your server administrator.

Dedicated server: AlmaLinux, Rocky, RHELSSH access, packages via dnf

Example for PHP 8.3 – replace 8.3 with your branch. In your check result, the assistant fills in your version automatically.

Update PHP packages (e.g. from Remi or AppStream):
```
sudo dnf upgrade 'php*'
```

Restart PHP-FPM and web server:

sudo systemctl restart php-fpm
sudo systemctl restart httpd   # or: sudo systemctl restart nginx

If the version remains below the fixed release, check backport status:
```
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'
```
Use the verification file to confirm that a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) is running.

DockerPHP runs in a container

Example for PHP 8.3 – replace 8.3 with your branch. In your check result, the assistant fills in your version automatically.

Update the base image in your Dockerfile to the fixed release (choose -fpm, -apache or -cli variant as appropriate):
```
FROM php:8.3.36-fpm
```
As soon as the official image is available; alternatively pull php:8.3-fpm anew.
Rebuild the image and restart containers:
```
docker compose build --pull
docker compose up -d
```
Check version inside container (adjust service name):
```
docker compose exec app php -v
```

Can’t update yourself?

Write to your hosting provider – the text is ready

If you can’t change the version yourself or the patched version isn’t available yet, copy this text, add your domain and name and send it to your provider.

Hello,

for my website [YOUR DOMAIN], I would like to resolve the critical PHP security vulnerabilities CVE-2026-109618 and CVE-2026-109619 (published on 2026-10-21). According to the PHP project, these are fixed in: PHP 8.2: from 8.2.35, PHP 8.3: from 8.3.36, PHP 8.4: from 8.4.27, PHP 8.5: from 8.5.12.

Please
1. switch my website to a fixed release or install the update and inform me of the exact version, or
2. confirm that your package includes a backported security patch for both CVEs.

When can this be completed?

Thank you and best regards,
[YOUR NAME]

After

Check that it worked

Restart the PHP processes, or wait a few minutes until your hosting provider has applied the change.
Open the website in your browser and briefly test the most important pages and forms.
Run a new confirmed check with the verification file – it shows the version your website really runs.
Delete the verification file afterwards.

Special case

Old version (PHP 8.1 or older)

The PHP project no longer provides security updates for these branches. Switching to 8.3 or 8.4 can break older plugins, themes or custom code. Here’s how to proceed safely:

Create a backup.
Update your CMS (e.g. WordPress, Shopware, TYPO3), plugins and themes to the latest version first.
If possible, switch a test copy (staging) first – many hosting providers offer this with one click.
Switch the PHP version and test the website thoroughly. If there are problems, you can usually revert the setting immediately in the customer area.

Important

An update doesn’t remove an earlier attack

Both vulnerabilities were open until their disclosure on 21 Oct 2026. The update closes them for the future, but doesn’t remove anything that was planted before. Look out for unknown files, new admin accounts or unusual behaviour, and if in doubt, have the server checked by professionals.

Rather have it done for you?

Denkcode checks your actual PHP version and helps with the update. Write to anfrage@php-checker.de or give us a call.

Contact Denkcode