Dear Customers and Partners,

On October 21, 2026, the PHP development team disclosed 02 critical security vulnerabilities. Both allow an attacker to execute code remotely (RCE) through a website and take control of the server:

  • CVE-2026-109618: Remote code execution via memory corruption when memory is exhausted (OOM corruption)
  • CVE-2026-109619: Remote code execution via global state that is not reset (stale global state)
  • Severity: Critical
  • Affected versions: All PHP versions prior to 8.5.12, 8.4.27, 8.3.36 and 8.2.35
  • Affected environments: Every PHP server that serves websites, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The highest risk is with Apache mod_php, where the vulnerabilities can be exploited before the website's source code even runs.

Below are the emergency measures and patching progress from the Sudo Engineering Team.

I. URGENT NOTICE: INFRASTRUCTURE DEFENSE PROCEDURE ACTIVATED
(1:00 PM, October 21, 2026)

As soon as the alert was received, Sudo's engineering team activated its emergency response procedure:

  • Full review: Checked every Cloud Server and Hosting system operated by Sudo to determine the scope of impact.
  • Additional protection layer: Deployed web application firewall (WAF) rules at the server level to block scanning and exploitation attempts while waiting for the official patches.
  • 24/7 monitoring: Closely monitored logs and traffic to detect and respond to any anomalies promptly.

II. UPDATE: PATCH UPGRADES COMPLETED
(Updated at 9:10 PM, October 21, 2026)

The PHP development team has officially released patches for PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 and 7.4. For PHP 7.2, the community-maintained Sury PHP package repository (packages.sury.org), widely used on Debian/Ubuntu, has released backported patches for both vulnerabilities.

After compatibility testing, Sudo rolled out the updates as follows:

PHP versionSolutionStatus
PHP 8.5Upgraded to the official patch release 8.5.12Completed
PHP 8.4Upgraded to the official patch release 8.4.27Completed
PHP 8.3Upgraded to the official patch release 8.3.36Completed
PHP 8.2Upgraded to the official patch release 8.2.35Completed
PHP 7.4Upgraded to the backported patch (PHP Security Team / Sury 7.4.33-31)Completed
PHP 7.2Applied the backported patch from Sury (7.2.34-66) and kept WAF in placeCompleted
Other EOL versionsDedicated WAF rules kept in place to block the attack vectorsMitigation applied

Note: According to the PHP development team, only installing the patch fully fixes the vulnerabilities. Configuration changes and WAF rules only reduce the risk for some attack vectors. The PHP 7.2 patch is community-maintained and has not been independently reviewed, so Sudo keeps additional protection layers in place alongside it.

Recommendations for customers

  • Websites and servers managed by Sudo (PHP 7.4 and later): Already patched and running stably. No action is required on your part.
  • Websites running PHP 8.1 or earlier: These versions are no longer supported and will not receive patches for future vulnerabilities. Sudo recommends planning an upgrade to PHP 8.2 or later. Our engineering team is ready to help check source code compatibility and carry out the upgrade.
  • Customers who manage their own VPS/Cloud Server: Please update PHP to the patched versions listed above immediately, using your operating system's package repository or the Sury repository. If you cannot update right away, you can temporarily apply the mitigations recommended by PHP:
    • Set session.upload_progress.enabled=0 in php.ini or in the FPM pool configuration, then restart all PHP workers.
    • Limit post_max_size (8M if the website does not need file uploads, 32M if it does) and keep upload_max_filesize below that value.
    • For PHP 8.5: set fatal_error_backtraces=0 and restart the workers.
    • These measures only reduce the risk and do not replace installing the patch. See the full guidance at the official links below or contact Sudo for support.

Further information

Security is a process of continuous monitoring. Sudo will keep tracking the situation and update this article as new information becomes available.

Contact support

Thank you sincerely for your trust and cooperation!