PHP Security Patch October 2026: What Laravel Devs Must Do

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix critical RCE flaws CVE-2026-109618 and CVE-2026-109619. Who is affected and how to patch Laravel on Forge, Ubuntu, Docker and cPanel.

TL;DR: Key Takeaways

On October 21, 2026, the PHP team released security updates for all supported branches.

Patched versions: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, PHP 8.2.35.

Vulnerabilities: CVE-2026-109618 and CVE-2026-109619, Remote Code Execution (RCE) flaws in PHP core (memory management and error handling; exact technical details are in the official advisory).

Urgency: Critical (CVSS 9.2). Patch production servers today.

Laravel itself is not the problem. Your app is exposed if the PHP runtime under it is unpatched.

On AWS or Azure? Turn on WAF protection now while you schedule the upgrade.

What Happened on October 21, 2026?

On October 21, 2026, the PHP project released new point versions for its supported branches. The release fixes two security issues: CVE-2026-109618 and CVE-2026-109619.

The flaws are in the PHP core. An attacker who can send crafted input could execute arbitrary code remotely, without authentication.

PHP runs under every Laravel request, so a runtime bug skips your application code entirely. Validation rules, middleware and policies cannot protect you from a flaw in the interpreter.

Who Is Affected?

PHP Version Ranges

PHP Branch	Vulnerable Versions	Patched Version	Support Status
PHP 8.5	< 8.5.12	8.5.12	Active support
PHP 8.4	< 8.4.27	8.4.27	Active support
PHP 8.3	< 8.3.36	8.3.36	Security fixes only
PHP 8.2	< 8.2.35	8.2.35	Security fixes (EOL Dec 31, 2026)
PHP 8.1 and older	All	No official patch	End of life

What It Means for Laravel

Laravel 13 requires PHP 8.3+. Laravel 11 and 12 support PHP 8.2+.
A patch release within the same branch (e.g., 8.4.26 to 8.4.27) needs no code changes.
Your Laravel version doesn't decide whether you're exposed. Your server's PHP version does.

PHP-FPM vs. mod_php

PHP-FPM: restart the FPM service after upgrading. Old workers keep running the vulnerable binary until you do.
mod_php: PHP runs inside Apache, so restart Apache.
CLI workers (queues, Horizon, scheduler): restart them too. They hold the old binary in memory.
Shared hosting: your host patches PHP. Check that the patched version is active in your control panel.

Not sure what to restart on your setup? See how to restart and harden Apache and Nginx after a PHP upgrade.

Step-by-Step: Upgrading PHP for Laravel

Before you start: back up or snapshot the server, and test on staging first.

1. Laravel Forge / Ploi

Forge: open your server, go to PHP, and click Update for your version.
Ploi: go to Server → PHP and run the update.
Restart queue workers and daemons from the panel.

2. Ubuntu/Debian (Ondřej Surý PPA)

sudo apt update
sudo apt install --only-upgrade 'php8.4*'
php -v

The PPA can take a few hours to publish new builds. If the version hasn't changed yet, run apt update again later.

3. RHEL / Rocky / AlmaLinux (Remi)

sudo dnf upgrade 'php*'
php -v

4. Docker / Laravel Sail

FROM php:8.4.27-fpm

docker compose build --pull --no-cache
docker compose up -d

# Sail
sail build --no-cache && sail up -d && sail php -v

5. cPanel, Plesk, aaPanel

cPanel/WHM: run /scripts/upcp as root, then check the version in MultiPHP Manager.
Plesk: go to Tools & Settings → Updates and update the PHP components.
aaPanel: go to App Store → PHP → Update, then restart PHP.

Verification Checklist

php -v
php artisan config:clear
php artisan cache:clear
php artisan optimize
php artisan queue:restart
php artisan horizon:terminate   # if using Horizon

Then restart PHP-FPM or Apache. The CLI and the web server can run different PHP binaries, so check both. The Apache and Nginx guide has the exact commands.

Temporary Mitigation (Not a Full Fix)

These steps reduce risk. They do not remove the vulnerability. Upgrade PHP as soon as possible.

Disable upload progress tracking: set session.upload_progress.enabled = Off in php.ini. On PHP-FPM, also add php_admin_flag[session.upload_progress.enabled] = off to your pool configuration. This reduces the attack surface for CVE-2026-109619 but does not cover all exploit paths.
Block multipart requests at the WAF or proxy: if you do not need file uploads, block requests with Content-Type: multipart/form-data. If blocking is not feasible, log and monitor multipart requests instead.
Set APP_DEBUG=false in production.
Restrict exposure of admin panels and upload endpoints.
Watch logs for segfaults in php-fpm.log and spikes in 500 errors.
Turn on a Web Application Firewall (WAF). See our guide to AWS WAF and Azure WAF rules for PHP and Laravel.

Why Acting Now Matters

Security releases come with public patch diffs, and attackers study them. A working exploit can follow within days.

Exploitation status: attempts are active, but confirmed breaches are scarce. Amazon's CISO reported exploitation attempts as early as October 17, four days before the patch was released. Cloudflare's CEO stated that thousands of attempts were observed in the 10 hours before the announcement, rising to tens of thousands within 45 minutes, hundreds of thousands within 2 hours, and millions after that.

However, Germany's BSI and the Dutch cyber agency reported no successful exploitation in their jurisdictions, noting the flaw appears "more complicated than expected to exploit". Researchers found that most public proof-of-concept code was unreliable or non-functional against real targets.

Automated scanners target freshly disclosed flaws first, and Laravel stacks are easy to fingerprint. A patch upgrade takes minutes. Cleaning up a breach takes far longer.

Long-Term Best Practices

Follow official channels: php.net releases and Laravel security advisories.
Stay on a supported PHP branch, and plan upgrades before end of life.
Automate patch updates with unattended-upgrades or scheduled image rebuilds.
Pin versions in composer.json and your Dockerfiles.
Run composer audit in CI.
Keep WAF managed rules on permanently on AWS or Azure, not only during incidents.
Keep a restart runbook that covers FPM, Apache or Nginx, queues, Horizon and the scheduler.

Need help patching or hardening a Laravel application? See our website development services or talk to our team.

Frequently Asked Questions

Which PHP versions fix the October 2026 vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier releases and end-of-life branches are vulnerable.

Do I need to update Laravel to fix this?

No. The flaw is in the PHP runtime. Update PHP on your server.

Do I need to restart Apache or Nginx after updating PHP?

With mod_php, restart Apache. With PHP-FPM (Nginx or Apache), restart the FPM service; reloading the web server is optional. Also run php artisan queue:restart for your workers.

Can AWS WAF or Azure WAF fully protect my Laravel site?

No. A WAF reduces risk by blocking known attack patterns, but it can be bypassed. Upgrading PHP is the only full fix.

Will a PHP patch update break my Laravel app?

Rarely. Same-branch patch releases contain only bug and security fixes. Test on staging anyway.

Official sources: PHP Releases · PHP Supported Versions · CVE-2026-109618 · CVE-2026-109619 · Forge PHP Security Advisory · Laravel Blog: PHP Critical Vulnerability Response

SysNova Technologies, H NO 152 Muradgarhi, YEIDA Development Area, Gautam Buddh Nagar, 203209
Phone: +91 9793760210
Email: sales@sysnovatech.com