Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619: how to patch your LMS today

On 21 October 2026 the PHP project released emergency security updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. Both are rated 9.2 (critical) under CVSS v4.0. If your LMS runs on PHP, which includes Moodle, Totara, WordPress with LearnDash, Tutor LMS or LifterLMS, Chamilo and ILIAS, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today and restart every PHP process.

The PHP security team says plainly that there is no complete workaround: updating is the only safe choice. Sites that use Apache with mod_php are at the highest risk, because the PHP team has a working exploit there that fires before any application code runs. PHP 8.1 and older will not get an official fix.

This guide explains what the two vulnerabilities are, who is affected, how to patch on the most common LMS hosting setups, what to do if you cannot patch right now, and how to check whether a server was attacked. It is written for LMS owners, IT teams and agencies who need to act today, and it sticks to what the PHP project and named security teams have published.

What happened: the php2shell vulnerabilities in brief

The PHP project published two advisories on 21 October 2026:

In both cases the confirmed impact is unauthenticated remote code execution with the permissions of the web server's PHP worker account. In practice that means an attacker who succeeds can read your LMS configuration (including database passwords), read or change learner records, plant a backdoor, or use the server to attack others.

The flaws are in the PHP interpreter itself, not in Moodle, WordPress or any plugin. Updating your LMS, theme or plugins does not fix them. Only updating PHP does.

Why this one is urgent

• It was public before the patch. According to Tenable and Huntress, details circulated on 20 October, ahead of a disclosure originally planned for 22 October, and the PHP project moved the release forward to 21 October at 14:00 UTC.
• Attacks may already be under way. Reports differ. Tenable quotes Cloudflare's CTO saying on 21 October that early attacks were emerging. Patchstack reports confirmed exploitation incidents. Huntress said that, as of 10:00 ET on 21 October, it had not yet seen exploitation across its partner base. Code claiming to exploit the bugs is circulating publicly, and Tenable warns that unverified exploit code is sometimes laced with malware.
• No login is needed, and on mod_php the PHP team says the attack can trigger before any application code runs, so your LMS's own security settings cannot stop it.
• The exposure is huge. Tenable cites estimates of more than 1.3 million internet-facing hosts that may be vulnerable.

Treat this like a fire alarm, not a routine update. Patch internet-facing LMS servers first.

Is my LMS affected?

The PHP project says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php. Use this table to place your platform:

Do not forget the less obvious PHP: a hosting control panel, a WordPress marketing site on the same server, a reporting tool, or an old staging copy of your LMS that is still online.

Fixed PHP versions

For PHP 8.1 and older, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Some Linux distributions and long-term-support vendors also backport fixes, so a distribution package can be safe even if its version number looks older. Check your vendor's advisory rather than the number alone.

How to patch: step by step

1. Find out which PHP version your site really uses

The command line and the web server can use different PHP versions, so check both:

• On the server: php -v, and ls /etc/php on Ubuntu or Debian to see every installed version.
• In Moodle: Site administration, then Server, then PHP info.
• In WordPress: Tools, then Site Health, then Info, then Server.
• To see whether Apache runs PHP as mod_php (highest risk): apachectl -M | grep -i php. A line such as php_module means mod_php.

2. Install the patched packages

On Ubuntu or Debian, replace 8.3 with your version:

sudo apt-get update
apt-cache policy php8.3-fpm php8.3-common
sudo apt-get install --only-upgrade 'php8.3-*'

The "Candidate" line from apt-cache policy should show the patched release, or your distribution's patched build. If it does not, the packages have not reached your repository yet: check again shortly and use the temporary measures below in the meantime.

• Third-party PHP repositories: if PHP comes from Ondrej Sury's packages (the ondrej/php PPA or packages.sury.org), Ubuntu's automatic security updates do not upgrade it, as Laravel Forge points out. You must run the upgrade yourself.
• Remi's repository (RHEL, Rocky, AlmaLinux): the PHP project said on 21 October that rpms.remirepo.net would not have updates that day and urged users to switch to distribution packages or build from source.
• Shared hosting and cPanel / Plesk: ask your host which patched PHP builds are available, then select them for your site in the PHP selector.
• Docker: rebuild your images on a patched PHP base image (check the tag shows the fixed version) and redeploy every container.
• Windows: download the patched binaries from php.net.

3. Restart every PHP process

New packages do nothing until the running processes are replaced:

• PHP-FPM: sudo systemctl restart php8.3-fpm (use your version).
• Apache with mod_php: sudo systemctl restart apache2 (or httpd).
• Long-running CLI processes, such as Moodle ad hoc task runners started with --keep-alive, queue workers and supervisors, keep the old PHP in memory until they restart.

4. Confirm the fix is live

Run php -v (and php-fpm8.3 -v for FPM) again, and check the PHP version in your LMS admin screen. Both must show the patched version.

Need help patching your LMS today? Our engineers can patch PHP on your Moodle, Totara or WordPress LMS servers, restart every worker, check for signs of compromise and confirm the fix. Request emergency PHP patching.

If you cannot patch right now

The PHP project lists measures that reduce exposure to specific attack paths, and it is clear that they do not make an installation safe. Use them only to buy hours, not weeks:

• For CVE-2026-109618: set memory_limit=-1 in a place applications cannot override (for example php_admin_value in the FPM pool or Apache configuration) and check nothing sets a finite limit again. Set a low post_max_size (8M if you do not need uploads, 32M if you do) with upload_max_filesize below it, and enforce request size and multipart limits at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable failure.
• For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the pool configuration and restart every worker (not via ini_set() or .user.ini). On PHP 8.5, also set fatal_error_backtraces=0. Remove invalid or deprecated per-request settings that emit warnings, and fix fatal errors and timeouts that visitors can trigger.
• At the edge: Tenable reports that Cloudflare released WAF rules for all plans, including the free plan, but Cloudflare itself calls them a stopgap and they only protect traffic that actually passes through Cloudflare.
• For end-of-life PHP: CERT-EU recommends isolating internet-facing applications until a fix is in place, for example behind a VPN.

Note that memory_limit=-1 has a cost of its own: a single runaway request can then use far more memory, so watch the server closely and remove the setting once you have patched.

How to check whether your server was attacked

No confirmed indicators of compromise had been published at the time of writing. Huntress suggests watching for behaviour instead:

• PHP or web server processes (php-fpm, php-cgi, httpd, apache2) starting shells, interpreters or download tools such as curl and wget.
• Command lines containing /dev/tcp/, fsockopen or mkfifo, or reconnaissance commands such as whoami, id and uname -a started by the web server.
• New or recently changed PHP files in the web root and upload folders (for Moodle, also check that nothing executable appears in moodledata), new cron jobs, and new admin accounts in your LMS.

If you find signs of compromise, take the server off the network, keep the web and PHP logs, and treat every secret on it as exposed: database passwords, API keys, SSO certificates and SMTP credentials. Restoring from a clean backup onto a patched server is usually safer than trying to clean a live one. If learner personal data may have been accessed, your data protection obligations may require you to report it, so involve your data protection lead early.

After the patch: harden for the next one

• Move off mod_php. The PHP team rates mod_php as the highest-risk setup for these bugs. PHP-FPM behind Apache (event MPM) or Nginx is the modern default and isolates PHP from the web server.
• Keep PHP on a supported branch. PHP 8.2 loses security support on 31 December 2026. Moodle 5.2 and newer already need PHP 8.3 or later.
• Put a WAF or CDN in front of public LMS sites, so emergency rules can be switched on within minutes.
• Write down who patches what. A common reason a server stays unpatched is that nobody is clearly responsible for it: name an owner for every LMS server, staging copy and control panel.
• Run a regular security review. Our LMS security checklist covers the controls auditors ask about, and our LMS security services can run the review for you.

How we can help

All-in-One LMS engineers build, patch and maintain PHP-based learning platforms, from single Moodle servers to multi-server WordPress LMS setups. For this incident we can update PHP and restart every worker, apply the temporary mitigations where an update must wait, check your servers for the warning signs above, and plan a move to PHP 8.3 or newer for Moodle and WordPress LMS sites still on old versions. If you would rather hand the job over for good, our LMS maintenance and support plans include security patching. Contact us now and tell us your LMS and hosting: we prioritise sites that are still unpatched.