PHP critical RCE fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35): patch your self-hosted PHP apps

Verdict: update now. This is one of the rare cases where “wait a week” is the wrong advice.

What happened

• On October 21, 2026 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution (php.net news, PHP Foundation).
• PHP says “there are no complete mitigations, updating is the only safe choice.”
• Affected: 8.5.0–8.5.11, 8.4.0–8.4.26, 8.3.0–8.3.35, 8.2.0–8.2.34. PHP 5.4–8.1 get no fix, because they’re end-of-life (AWS bulletin).
• CERT-EU reports that proofs of concept have started circulating, so exploitation is more likely (CERT-EU 2026-018). On October 23 PHP also disclosed a further RCE that only affects unusually configured apps, with a mitigation instead of a new release.
• PHP 8.2 reaches end of life on December 31, 2026.

Which homelab apps are affected

Anything that runs PHP: Nextcloud, WordPress, Pi-hole’s older web UI, FreshRSS, Firefly III, BookStack, Matomo, phpMyAdmin and more. The PHP version comes from the container image or the host packages, not from the app version.

How to update safely

1. Check what PHP you run:

   docker exec <container> php -v

2. Back up first: the app’s volumes and its database dump. See pin tags and back up volumes.
3. Pull the rebuilt image. Most official and linuxserver.io images rebuild on new PHP releases. Pull, recreate, then run php -v again to confirm the version is 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or later.

   docker compose pull && docker compose up -d

   If the image still ships an old PHP, check the project’s release page or issue tracker for a rebuild.
4. Bare-metal hosts: install your distro’s security update (apt upgrade on Debian/Ubuntu, dnf upgrade on Fedora/RHEL) and restart PHP-FPM.
5. Still on PHP 8.1 or older? There’s no fix. Move to a supported branch, or at least take the app off the internet (put it behind Tailscale or another VPN) until you migrate.

If you can’t update today

Don’t expose PHP apps directly to the internet. Put them behind a VPN or an authenticating reverse proxy, then update as soon as you can. That reduces exposure, but it isn’t a fix.