Incident Report

Incident report: PHP remote code execution vulnerabilities

October 20–21, 2026. Status: resolved.

S

Sitery Team

Northern Nevada

Summary

The PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow an unauthenticated request to run code on a server running PHP. No fixed version was available at the time. We took every WordPress site on Sitery offline until fixed versions were released. Sites were back online on fixed PHP about an hour after the release.

Timeline (UTC)

  • October 20: Vulnerabilities announced. A public proof-of-concept exploit appears.
  • October 21, 05:38: Maintenance page enabled on all WordPress sites and PHP stopped.
  • October 21, 14:00: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released.
  • October 21, 14:30: Patched PHP images built and verified.
  • October 21, 14:40: Site PHP restarted on patched versions.
  • October 21, about 15:00: Maintenance page removed from all sites. All sites confirmed responding.

Impact

  • Every WordPress site on Sitery showed a maintenance page for about nine and a half hours.
  • No site data was lost.

Cause

CVE-2026-109618: when PHP runs out of memory while setting up a request, cleanup code can treat partially built request data as valid. CVE-2026-109619: internal state from one request can survive after its memory is freed and be used by the next request handled by the same PHP worker. Both affect PHP-FPM, which runs WordPress on Sitery.

Why we took sites offline

The PHP advisory listed temporary mitigations and stated that they “reduce exposure to specific attack paths but do not make an installation safe.” Exploit code was public and attacks were being reported. We chose downtime over running sites on a partial fix.

What we did

  • The official PHP Docker images had not been updated when the fix was released. We built PHP from the php.net source releases, verifying each archive’s signature and checksum first.
  • Rebuilt the WordPress PHP images for all supported versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • Confirmed every running PHP container reported a patched version before removing the maintenance pages.

What you need to do

Nothing for sites hosted on Sitery. If you run PHP elsewhere, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution’s patched package. PHP 8.1 and older no longer receive fixes from the PHP project.

If anything on your site has not looked right since it came back online, open a support ticket.