The PHP project has scheduled a critical PHP security release for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM EDT). It fixes two critical flaws, both rated 9.2 on the Common Vulnerability Scoring System (CVSS) v4.0 scale. InMotion Hosting is applying a precaution on the servers it manages now and will deploy the fixed PHP builds after PHP publishes them. Check your PHP version today, because older PHP branches may not get a fix.
Note: We published this article before PHP released the patch, so details are limited. We will update this page with the Common Vulnerabilities and Exposures (CVE) details, affected versions, and fixed versions once PHP publishes them.
What We Know About the PHP Security Release
Confirmed by PHP
PHP’s advance notice, titled “Upcoming Critical PHP Security Release,” says the release fixes two critical vulnerabilities. PHP will publish full details, affected versions, and fixed versions with the release. It may release earlier if details become public or attacks appear in the wild. PHP’s last security releases, 8.5.11, 8.4.26, 8.3.35, and 8.2.34, came out on September 24, 2026.
Reported by researchers
The identifiers CVE-2026-109618 and CVE-2026-109619 are reserved on cve.org. The PHP notice does not name them, so the link to this release comes from researcher reports. Word of the flaws leaked on October 20, ahead of the official release.
Security firm watchTowr describes the flaws as reported remote code execution (RCE) bugs, which would let an attacker run code on a server. It notes that no official advisory has confirmed their scope or cause yet (see the watchTowr FAQ). Huntress says it is not aware of public exploit code and had not seen attacks in the wild as of October 20. Huntress expects technical details and proof-of-concept code to follow quickly once the fixes ship.
Unconfirmed
Leaked claims say every PHP version from PHP 5 onward is affected. Reports also suggest only the supported branches (8.2, 8.3, 8.4, and 8.5) will get official fixes. If true, PHP 5.x, 7.x, 8.0, and 8.1 would get no fix from PHP. One researcher report also ties the flaws to PHP’s session upload progress feature. PHP has confirmed none of this. For context, PHP 8.2 security support ends December 31, 2026.
What InMotion Hosting Is Doing
As a precaution, the InMotion Hosting systems team is turning off the PHP session.upload_progress.enabled setting on the servers InMotion Hosting manages. The reason is the reported link to session upload progress, which PHP has not confirmed. The PHP manual already suggests disabling this option in applications that do not use upload progress bars. It warns that client-supplied file names and field names are not validated.
This change is a precaution. It is not a substitute for the patch.
Who this affects
The setting only controls upload progress tracking. Sites that do not show upload progress bars built on this PHP feature will not notice a change. A custom PHP application that builds a progress bar from $_SESSION and the PHP_SESSION_UPLOAD_PROGRESS field will stop reporting progress. The upload itself still completes. Progress reporting works again once the setting is turned back on.
Important: Do not turn this setting back on in a .user.ini or php.ini file until InMotion Hosting has deployed the patched PHP builds.
Patch deployment
After PHP publishes the fixed versions, InMotion Hosting will deploy the patched builds on Shared, Reseller, and WordPress Hosting servers. You do not need to act on these plans. cPanel delivers PHP as EasyApache 4 packages, so the fix reaches cPanel servers when cPanel publishes updated ea-php packages.
What You Should Do
Shared, Reseller, and WordPress Hosting: check your PHP version. If you run 7.x, 8.0, or 8.1, move to a supported PHP version and test your site first. Those branches may not receive a fix.
VPS and Dedicated with root access: when the updated packages appear, update PHP through the WHM EasyApache 4 interface or with your server’s package manager. If you must stay on an end-of-life PHP version, InMotion Hosting offers TuxCare PHP Extended Lifecycle Support for patched legacy PHP.
Review any custom code that accepts file uploads, and keep your applications and plugins current. You can follow the InMotion Hosting status page for service updates.
What Comes Next
PHP plans to publish the CVE details, affected versions, and fixed versions at 14:00 UTC on October 21, or sooner if circumstances change. Watch the PHP news archive for the official release notes. InMotion Hosting will update this article with those facts, the confirmed deployment status, and any change to the precaution described here.