PHP Security Alert: What ExpressionEngine Site Owners Need to Know

Updated October 21, 2026

TL;DR

• Contact your hosting provider today to confirm that fixes for both PHP vulnerabilities are installed and active for your website.

• Confirm which PHP version your site is running and whether your host has upgraded or patched it.

• Make sure your ExpressionEngine version supports the patched PHP version your host is using. If it does not, you will need to upgrade ExpressionEngine.

• Temporary mitigations, including correctly configured Cloudflare WAF protection, can reduce exposure but do not replace the PHP update.

If you run an ExpressionEngine website, contact your hosting provider today to confirm that your site is running a patched PHP release. If your site uses an older version of ExpressionEngine, we strongly recommend upgrading to the latest ExpressionEngine 7 as soon as possible.

Today, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow attackers to execute code on affected servers without logging in.

PHP is the software that runs ExpressionEngine, as well as WordPress, Drupal, and many other platforms; it powers nearly 70% of websites whose server-side programming language is known. These vulnerabilities require attention to your hosting environment, including for sites already running the latest EE release. Updating ExpressionEngine alone does not apply the PHP fixes.

We want to help you understand what this means for your site and where to get help.

Contact Your Hosting Provider Today

Ask your host to confirm that fixes for both vulnerabilities are installed and active for your website. They should handle the PHP update, any necessary service restarts, and verification that your site is using the patched build. Ask them to apply relevant operating-system security updates as well.

The PHP security announcement lists these fixed releases:

PHP branch	Minimum patched release
PHP 8.2	8.2.35
PHP 8.3	8.3.36
PHP 8.4	8.4.27
PHP 8.5	8.5.12

Use the listed version or a later maintenance release within the same branch. Simply being on “PHP 8.2 or newer” does not confirm that the fix is installed.

The official PHP releases listed above are for PHP 8.2 and newer. Some operating system vendors are also backporting these fixes to PHP versions older than 8.2. Ask your hosting provider to confirm that the PHP build running your site includes fixes for both vulnerabilities, regardless of its version number.

Also ask your host to check any publicly accessible staging sites, subdomains, and other installations on your account.

What Your ExpressionEngine Version Means

ExpressionEngine 5 and Earlier

ExpressionEngine 5 and earlier are retired and do not support PHP 8.2, the oldest PHP branch currently supported by the PHP project. These versions can prevent you from moving to a supported PHP release.

We strongly recommend upgrading to the latest ExpressionEngine 7 as soon as possible. Work with your developer or an ExpressionEngine Professional in our Partner Network to arrange the upgrade, while your host addresses your immediate PHP exposure.

ExpressionEngine 6

ExpressionEngine 6 is a legacy release, with security support ending on December 31, 2026.

PHP 8.2 compatibility was added in ExpressionEngine 6.4.15, so the specific EE6 release matters. Have your developer confirm compatibility before changing PHP branches.

Get PHP patched now, and prioritize your move to the latest ExpressionEngine 7.

ExpressionEngine 7

PHP 8.2 compatibility was first added in ExpressionEngine 7.2.8. If you are running an earlier 7.x release, update to the latest EE7 so your site can run patched PHP 8.2. Keep your site on the latest EE7 maintenance release and have your host confirm that PHP is patched. Your EE release, add-ons, and custom code determine which PHP branches your site can use.

Our system requirements and release notes provide compatibility information.

ExpressionEngine 8 remains on track for release before the end of the year, but please do not wait for EE8 to address this issue. Read more about EE6’s end of life and the upcoming EE8 release.

PHP 8.2 also reaches the end of upstream security support on December 31, 2026. It is a valid option for applying today’s fixes, but plan a move to a newer supported PHP branch with your developer.

Temporary Protection While Your Host Applies Updates

If your host cannot apply the PHP fixes immediately, ask which temporary protections are appropriate for your site. These measures can reduce exposure to particular attack paths, but they do not replace the PHP security update.

Your host should apply and verify the changes, taking your site’s forms, uploads, integrations, and server capacity into account.

Review PHP Configuration

The official PHP advisories describe several options for hosts to consider:

• Disable session upload progress: session.upload_progress.enabled = 0 reduces exposure to confirmed session-related attack paths. It must take effect before request parsing.

• On PHP 8.5, disable fatal-error backtraces: fatal_error_backtraces = 0 addresses another confirmed attack path.

• Review memory-limit handling: memory_limit = -1 removes a PHP memory-limit condition used by a confirmed attack. It also removes PHP’s per-request memory ceiling, so the host must assess resource controls and availability risks. Allocation failures can still leave the vulnerable path reachable.

These options are described in the stale global state advisory and out-of-memory corruption advisory.

Limit PHP Workers to One Request

For sites using PHP-FPM, the PHP advisory also suggests considering pm.max_requests = 1.

This replaces each PHP worker after it handles one request, reducing the opportunity for vulnerable state to carry over into a subsequent request. It adds a layer of protection against the issue involving state retained between requests.

Repeatedly replacing workers adds overhead and can significantly reduce performance, especially under load. Ask your host whether this tradeoff is appropriate while a patched build is being applied. It does not resolve the separate out-of-memory vulnerability or provide complete protection against both issues.

See the PHP advisory for this option.

Apply Request Restrictions in Nginx or Apache

Your host can consider limiting request sizes, input counts, and multipart uploads before requests reach PHP. Where multipart requests are unnecessary, blocking them can reduce exposure to particular attack paths.

These restrictions can affect legitimate forms, uploads, and imports, so they need to suit your site. The PHP advisory provides the technical guidance.

Use Cloudflare Protection

Cloudflare has announced protections for these vulnerabilities through its free and paid Web Application Firewall.

If you already use Cloudflare, confirm that your site’s traffic passes through its proxy and that the relevant WAF protections are active. Using Cloudflare for DNS alone does not provide this protection.

Ask your host to restrict direct access to the origin server so traffic cannot bypass the WAF. If you do not currently use Cloudflare, discuss adding it with your host or developer as an additional protection.

Continue with the PHP update even when Cloudflare protection is enabled.

Get Help

You do not need to work through this alone.

• Contact your hosting provider to confirm your PHP patch status and discuss temporary protections.

• Join the ExpressionEngine Slack community to ask questions, compare notes, and connect with other developers and site owners.

• Reach out to an ExpressionEngine Partner if you need help assessing your site or arranging an upgrade.

• If you have an ExpressionEngine Support plan, contact our support team for help with EE compatibility, your upgrade path, or questions about your installation.

If you have noticed suspicious changes to your site, tell your host so they can investigate. Applying a patch does not undo an earlier compromise.

Contact your host today to confirm that PHP is patched, and if you are running an older version of ExpressionEngine, start your move to the latest EE7 now. We are here to help you take the next step.