How to Apply the Urgent PHP Security Update (CVE-2026-109618, 109619) on Ubuntu

How to check whether the two PHP remote code execution vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619) affect your Ubuntu server, and how to install the security update that fixes them.

1. What are these vulnerabilities?

According to the php.net announcement, both vulnerabilities are rated CVSS 9.2 and let an unauthenticated user run code on the server remotely. When PHP stops partway through a request, for example because it runs out of memory, the cleanup step can keep using corrupted state.

The announcement says the mod_php setup, where PHP runs as an Apache module, is affected the most. It also lists some configuration changes that reduce the risk, but states that updating is the only complete fix.

Fixed versions by PHP branch

This table covers PHP as distributed by php.net. Support dates are taken from the php.net supported versions table (checked on October 23, 2026).

Default PHP and fixed packages by Ubuntu release

PHP from the Ubuntu archive keeps its version number and only receives the fix. That is why php -v shows the same version number after the update. Compare your package version with the table below instead. The values come from the Ubuntu security notices (USN-8948-1, USN-8948-2) and CVE pages, and only LTS releases are listed.

PHP 8.1 on 22.04 is no longer supported by php.net, but Ubuntu added this fix to its package. Standard support for 20.04 has ended, so only servers with Ubuntu Pro can get the fixed package. Without Ubuntu Pro, you need to upgrade both Ubuntu and PHP.

2. Prerequisites

• An Ubuntu server and an account with sudo privileges
• PHP installed from the Ubuntu archive

Every step in this guide was tested on a newly created Droplet (1 vCPU · 1GB memory · 25GB SSD · Ubuntu 24.04 · Singapore). To reproduce a server that has not been updated yet, Apache and mod_php were first installed with the unfixed package (8.3.6-0ubuntu0.24.04.11).

All command output in this guide was captured in an English environment (LANG=C.UTF-8). If your server uses another language, only the message text may differ.

3. Check the PHP version and how PHP runs

First, check the installed PHP version. The server in this guide runs 8.3.6.

php -v

PHP 8.3.6 (cli) (built: Sep  2 2026 12:56:02) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.6, Copyright (c) Zend Technologies
    with Zend OpCache v8.3.6, Copyright (c), by Zend Technologies

Next, check how the web server runs PHP. The service you need to restart after the update depends on this. If php_module appears in the Apache module list, PHP runs as mod_php.

apache2ctl -M 2>/dev/null | grep -i php

 php_module (shared)

Also check whether PHP-FPM is in use. If nothing is printed, PHP-FPM is not installed.

systemctl list-units --type=service --all | grep -i fpm

4. Check the installed package versions

List the installed PHP packages and their versions. If the version is lower than 8.3.6-0ubuntu0.24.04.13, the fix is not installed yet.

dpkg -l | grep php8.3

ii  libapache2-mod-php8.3           8.3.6-0ubuntu0.24.04.11                          amd64        server-side, HTML-embedded scripting language (Apache 2 module)
ii  php8.3-cli                      8.3.6-0ubuntu0.24.04.11                          amd64        command-line interpreter for the PHP scripting language
ii  php8.3-common                   8.3.6-0ubuntu0.24.04.11                          amd64        documentation, examples and common module for PHP
ii  php8.3-opcache                  8.3.6-0ubuntu0.24.04.11                          amd64        Zend OpCache module for PHP
ii  php8.3-readline                 8.3.6-0ubuntu0.24.04.11                          amd64        readline module for PHP

5. Refresh the package lists

The version you can install is shown on the Candidate line of apt-cache policy. The output below was taken before refreshing the package lists. Even though the fixed package has been released, Candidate still shows .11, the same as the installed version, because the package lists on the server are older than the fix.

apt-cache policy libapache2-mod-php8.3

libapache2-mod-php8.3:
  Installed: 8.3.6-0ubuntu0.24.04.11
  Candidate: 8.3.6-0ubuntu0.24.04.11
  Version table:
 *** 8.3.6-0ubuntu0.24.04.11 500
        500 http://mirrors.digitalocean.com/ubuntu noble-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
        100 /var/lib/dpkg/status
     8.3.6-0maysync1 500
        500 http://mirrors.digitalocean.com/ubuntu noble/main amd64 Packages

Refresh the package lists.

sudo apt update

Hit:1 http://mirrors.digitalocean.com/ubuntu noble InRelease
Get:2 http://mirrors.digitalocean.com/ubuntu noble-updates InRelease [126 kB]
Get:5 http://security.ubuntu.com/ubuntu noble-security InRelease [126 kB]
...
Fetched 12.1 MB in 3s (3551 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
79 packages can be upgraded. Run 'apt list --upgradable' to see them.

Check again, and Candidate now shows the fixed .13.

apt-cache policy libapache2-mod-php8.3

libapache2-mod-php8.3:
  Installed: 8.3.6-0ubuntu0.24.04.11
  Candidate: 8.3.6-0ubuntu0.24.04.13
  Version table:
     8.3.6-0ubuntu0.24.04.13 500
        500 http://mirrors.digitalocean.com/ubuntu noble-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu noble-security/main amd64 Packages
 *** 8.3.6-0ubuntu0.24.04.11 100
        100 /var/lib/dpkg/status
     8.3.6-0maysync1 500
        500 http://mirrors.digitalocean.com/ubuntu noble/main amd64 Packages

List the PHP packages that can be updated, and check that every installed PHP package shows .13.

apt list --upgradable 2>/dev/null | grep php

libapache2-mod-php8.3/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.11]
php8.3-cli/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.11]
php8.3-common/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.11]
php8.3-opcache/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.11]
php8.3-readline/noble-updates,noble-security 8.3.6-0ubuntu0.24.04.13 amd64 [upgradable from: 8.3.6-0ubuntu0.24.04.11]

6. Install the security update

Update only the PHP 8.3 packages that are already installed. The --only-upgrade option upgrades installed packages and does not install new ones. 'php8.3*' matches every package whose name starts with php8.3, and -y answers yes to the confirmation prompt in advance.

A Skipping … it is not installed line appears for every package that is not installed. This is normal. The lines that matter are 5 upgraded and Setting up … (8.3.6-0ubuntu0.24.04.13). Only some of the Skipping lines are shown below.

sudo apt install -y --only-upgrade 'php8.3*' libapache2-mod-php8.3

Reading package lists...
Building dependency tree...
Reading state information...
Skipping php8.3, it is not installed and only upgrades are requested.
Skipping php8.3-dev, it is not installed and only upgrades are requested.
...
The following packages will be upgraded:
  libapache2-mod-php8.3 php8.3-cli php8.3-common php8.3-opcache
  php8.3-readline
5 upgraded, 0 newly installed, 0 to remove and 74 not upgraded.
...
Setting up php8.3-common (8.3.6-0ubuntu0.24.04.13) ...
Setting up php8.3-readline (8.3.6-0ubuntu0.24.04.13) ...
Setting up php8.3-opcache (8.3.6-0ubuntu0.24.04.13) ...
Setting up php8.3-cli (8.3.6-0ubuntu0.24.04.13) ...
Setting up libapache2-mod-php8.3 (8.3.6-0ubuntu0.24.04.13) ...
libapache2-mod-php8.3: not switching MPM - already enabled
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for php8.3-cli (8.3.6-0ubuntu0.24.04.13) ...
Processing triggers for libapache2-mod-php8.3 (8.3.6-0ubuntu0.24.04.13) ...

Running kernel seems to be up-to-date.

No services need to be restarted.

7. Check that the web server uses the new PHP

mod_php loads PHP into the Apache processes. Until Apache restarts, the old PHP keeps handling requests even after the package is replaced.

Ubuntu's libapache2-mod-php8.3 package restarts Apache automatically when it is updated. The Processing triggers for libapache2-mod-php8.3 line in the output above is that step. To confirm the restart, check Apache's Active time. It should be the same as or later than the time of the update.

systemctl status apache2 --no-pager | head -3

● apache2.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/apache2.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-10-23 09:40:26 UTC; 27s ago

On this server, Apache had started at 09:39:27 before the update and at 09:40:26 after it.

If you use PHP-FPM, restart the FPM service as well. Skip this command if no FPM service appeared in step 3.

sudo systemctl restart php8.3-fpm && systemctl status php8.3-fpm --no-pager | head -3

● php8.3-fpm.service - The PHP 8.3 FastCGI Process Manager
     Loaded: loaded (/usr/lib/systemd/system/php8.3-fpm.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-10-23 09:41:22 UTC; 20ms ago

8. Verify that the fix is installed

Check that every package version changed to .13.

dpkg -l | grep php8.3

ii  libapache2-mod-php8.3           8.3.6-0ubuntu0.24.04.13                          amd64        server-side, HTML-embedded scripting language (Apache 2 module)
ii  php8.3-cli                      8.3.6-0ubuntu0.24.04.13                          amd64        command-line interpreter for the PHP scripting language
ii  php8.3-common                   8.3.6-0ubuntu0.24.04.13                          amd64        documentation, examples and common module for PHP
ii  php8.3-opcache                  8.3.6-0ubuntu0.24.04.13                          amd64        Zend OpCache module for PHP
ii  php8.3-readline                 8.3.6-0ubuntu0.24.04.13                          amd64        readline module for PHP

You can also confirm the fix in the changelog shipped with the package. If the top entry shows SECURITY UPDATE, the fixed package is installed.

zcat /usr/share/doc/libapache2-mod-php8.3/changelog.Debian.gz | head -3

php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

  * SECURITY UPDATE: Remote RCE via state corruption issue

You can also search for the CVE numbers directly. If nothing is printed, the package has not been fixed.

zgrep -m1 -o "CVE-2026-109618_109619" /usr/share/doc/libapache2-mod-php8.3/changelog.Debian.gz

CVE-2026-109618_109619

The version in php -v stays at 8.3.6, but the build date has changed.

php -v | head -1

PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)

9. Check automatic security updates

By default, Ubuntu refreshes the package lists and installs security updates automatically once a day. If both values below are "1", this is turned on.

cat /etc/apt/apt.conf.d/20auto-upgrades

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

Even with automatic updates turned on, the unfixed version stays installed until the next run. When an urgent announcement like this one comes out, check the version yourself as in step 4 instead of waiting.

10. Troubleshooting