Critical PHP vulnerability on OVHcloud Bare Metal and VPS: verification and step-by-step update guide

On 21 October 2026, the PHP project released patches for two critical vulnerabilities in the core language, not in a specific CMS or framework. OVHcloud has published an operational guide on its blog aimed at customers running Bare Metal servers (Kimsufi, So you Start, Rise, Advance, Scale, High Grade) and VPS—that is, those managing their own software stack and not receiving automatic updates as WebCloud and shared hosting customers do.

The two vulnerabilities

These are CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2 out of 10. They concern memory handling between requests: the first occurs when an oversized request exhausts available memory and leaves data in an inconsistent state; the second when data from a previous request remains in memory and is reused by the next request. In both cases, an attacker can execute code with web server privileges, without requiring an account or password. Researchers have demonstrated the exploit on Apache mod_php and PHP-FPM, the two most common configurations.

Patched versions

Installed version	Action
8.5.x	Update to 8.5.12
8.4.x	Update to 8.4.27
8.3.x	Update to 8.3.36
8.2.x	Update to 8.2.35
8.1 and earlier versions down to 7.4	No official release: source patches and recompilation required
Below 7.4	No fixes planned: plan migration

To check your current version, simply run php -v via SSH. OVHcloud reminds you that the command-line output may differ from the version used by your site if multiple PHP versions are installed on the server: in that case, you should also check the web server or control panel configuration.

Update procedure

After taking a snapshot (on VPS) or backing up configurations and data (on Bare Metal), update packages with your distribution's package manager: sudo apt update && sudo apt upgrade on Debian/Ubuntu, sudo dnf upgrade on AlmaLinux/Rocky Linux. For PHP compiled from source, download the correct version from php.net; for Docker containers, rebuild the image on an updated PHP base. The step OVHcloud flags as most often overlooked is restarting the service: without sudo systemctl restart php8.x-fpm or sudo systemctl restart apache2/httpd, the vulnerable version remains running in memory even after package updates.

Those unable to update immediately can reduce risk by disabling upload progress tracking (session.upload_progress.enabled = 0 in php.ini) and, only on PHP 8.5, setting fatal_error_backtraces = 0. OVHcloud emphasises, however, that only updating provides complete protection.

It's worth noting that the 8.2 branch, just patched to 8.2.35, reaches end of life on 31 December 2026: those updating today will still need to plan their move to 8.3 or later before that date. For those still on versions prior to 7.4 with no patches available, current guidance from several security observers indicates exploitation attempts are already underway on the network, making the window to update particularly narrow.