Overview
On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0.
Laravel Forge’s automatic security updates do not patch PHP. Forge installs PHP from a dedicated package repository, and Ubuntu’s unattended upgrades only apply updates from Ubuntu’s own security repository. You must update PHP on each of your servers yourself, using one of the options below.
Affected PHP versions
Both vulnerabilities affect PHP versions dating back to 2004, so every PHP version that Forge can install is vulnerable until it is patched. Because PHP 8.1 and earlier will not receive a fix, servers running these versions will remain vulnerable. If any of your sites still run PHP 8.1 or earlier, we strongly recommend installing a supported PHP version and switching your sites to it.
Where Forge installs PHP from
Forge installs PHP from Ondřej Surý’s PHP packages. The package source depends on your server’s Ubuntu version:
Patched packages usually reach these repositories shortly after the upstream release, but they may not be available the moment PHP publishes the release. If the update does not install the fixed version, wait a little while and try again.
What you need to do
Step 1: Check your current PHP version
SSH into your server and check the PHP version that each site uses. Replace 8.4 with the version you want to check:
Make a note of the version displayed so that you can verify the upgrade afterward. To list every PHP version installed on the server, run:
Step 2: Update PHP
You may update PHP from the Forge dashboard or manually via SSH. We recommend the Forge dashboard because it also repairs the server’s PHP package source before upgrading.
Updating PHP restarts the PHP-FPM service for that version. Sites running that version may experience a few seconds of downtime, so you may want to update during a period of low traffic.
Forge dashboard
Manually via SSH
- Navigate to your server’s dashboard and click the PHP tab.
- Locate the PHP version you want to patch, open its dropdown menu and click Update PHP X.X.
- Confirm the update. Forge will upgrade that version’s PHP packages to the latest patch release and reload Nginx.
Repeat these steps for every PHP version installed on the server, including versions that your sites do not currently use. These steps are the same on Ubuntu 22.04, 24.04 and 26.04.If you manage many servers, you may also trigger the update through the Forge API rather than the dashboard.First, confirm that your server’s PHP package source is configured. The file you should see depends on your Ubuntu version:If the expected file is missing, use the Forge dashboard option instead. It reconfigures the package source automatically.Next, refresh the package lists and check which version will be installed. Replace 8.4 with the version you want to patch:The Candidate version should match the fixed version listed in the Affected PHP versions table. If it does not, the patched packages have not reached the repository yet, so wait and try again later.Finally, upgrade every installed package for that PHP version. The --only-upgrade flag ensures that no new packages are installed, and the --force-confold option keeps your existing php.ini and PHP-FPM configuration files:Repeat these commands for every PHP version installed on the server. These commands are the same on Ubuntu 22.04, 24.04 and 26.04. root and contains the manual commands above, then run it against all of your servers.
Step 3: Restart long-running PHP processes
The package upgrade restarts PHP-FPM. However, long-running PHP processes started from the CLI keep running the old version of PHP until they are restarted. These include queue workers, Laravel Horizon, Laravel Octane, Laravel Reverb, and any other background processes you have configured.
Restart these processes after updating PHP. For example, you may run the following in each affected Laravel application:
If PHP-FPM did not restart automatically, you may restart it from your server’s dashboard by opening the actions dropdown and selecting Restart PHP X.X.
Step 4: Verify the fix is active
Run the version check from Step 1 again and confirm that the version shown matches the fixed version in the Affected PHP versions table:
To confirm that PHP-FPM is also running the patched version, run:
For the official release announcement and full details of both vulnerabilities, see the PHP news archive at https://www.php.net/archive/2026.php. To learn more about managing PHP on your servers, see the PHP documentation.