PHP Security Fixes: What Bagisto Stores Must Do

The PHP security release of 21 October 2026 fixes two critical flaws in PHP, the language every Bagisto store runs on.

First, PHP fixed two critical flaws that can let an attacker run code on a web server.
Next, the fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
In addition, PHP 8.1 and older get no official fix, so those stores must move to a supported version.
Finally, if you manage your own server, you must update PHP yourself, today.

php security release-for bagisto stores. Overall, this post explains which servers the PHP security release affects, who must act, and how to patch PHP.

You can read the official PHP security advisory on php.net.

What the PHP Security Release Fixes

Two Critical Vulnerabilities

The PHP team released fixes for CVE-2026-109618 and CVE-2026-109619 on 21 October 2026.
CVE-2026-109618 allows remote code execution through out-of-memory corruption.
CVE-2026-109619 allows remote code execution through stale global state between requests.
Both flaws score 9.2 under CVSS v4.0.
Also, an unauthenticated request can trigger the attack on Apache with mod_php, before any application code runs.

Which Servers Are at Risk

PHP lists every installation that serves web requests as affected.
That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Bagisto is a Laravel application, so it runs on these same PHP setups.
Therefore, every Bagisto store stays at risk until its server runs a patched PHP release.

Patched Versions in the PHP Security Release

For PHP 8.5, install 8.5.12.
Likewise, PHP 8.4 users need 8.4.27.
On the 8.3 branch, the fix ships in 8.3.36.
Lastly, 8.2.35 patches PHP 8.2.
However, PHP 8.1 and older have reached end of life, and the PHP project ships no fix for them.

Who Needs to Act After the PHP Security Release

Fully Managed Bagisto Cloud Hosting

Bagisto Cloud Hosting is a fully managed service, and its plans list security patches as managed.
On a fully managed plan, our team applies PHP security patches to your store for you.
You don’t need to log in to a server, run any command or update Bagisto.
Still, you can confirm your PHP version with our support team at any time.

If You Manage Your Cloud Server Yourself, You Must Act

Others self-host Bagisto on their own infrastructure.
In both cases, nobody else updates PHP for you, so you must update it yourself.
Automatic OS updates often skip PHP too, because many servers install PHP from a separate package repository.
So check every server, even one with unattended upgrades turned on.

The PHP Version Your Bagisto Release Needs

Bagisto v2.5.0 requires PHP 8.4 or newer, so update to PHP 8.4.27 or 8.5.12.
Bagisto v2.4 runs on PHP 8.3 or 8.4, so update to PHP 8.3.36 or 8.4.27.
If your store still runs PHP 8.1 or older, no patch exists for you.
Instead, upgrade Bagisto to a release that supports PHP 8.3 or newer, then move PHP to a patched version.
Also note that PHP 8.2 gets security fixes only until 31 December 2026.

How to Install the PHP Security Release on Your Server

Step 1: Check Your Current PHP Version

Connect to your server over SSH, then run the command below.
Next, list every PHP version on the server, since each one needs its own patch.

php -v
ls /etc/php

Step 2: Update PHP

On Ubuntu or Debian, refresh the package lists and check which version the repository offers.
The Candidate line must show the patched version for your branch.
If it doesn’t, the patched packages haven’t reached your repository yet, so wait and try again.
Then upgrade only the PHP packages you already have, and keep your existing configuration files.
These examples use PHP 8.4, so swap the version number for each branch on your server.

sudo apt-get update
apt-cache policy php8.4-fpm

sudo apt-get install --only-upgrade -y \
  -o Dpkg::Options::="--force-confold" \
  $(dpkg -l 'php8.4*' | awk '/^ii/ {print $2}')

On another Linux distribution, install the patched PHP package from your vendor’s security advisory.
Vendor backports may keep an older version number, so check the advisory rather than the number alone.
If you run Bagisto in Docker, rebuild your image on a patched PHP base image, then redeploy it.

Step 3: Restart PHP and Bagisto’s Background Processes

The package upgrade usually restarts PHP-FPM, but restart it yourself if it didn’t.
Long-running PHP processes keep the old PHP in memory until they restart.
For Bagisto, these include queue workers, such as the broadcastable queue worker for real-time admin notifications.
They also include Laravel Reverb and Laravel Octane, if your store uses them.

sudo systemctl restart php8.4-fpm
php artisan queue:restart
php artisan octane:reload

Finally, restart Reverb or any other worker through the process manager that runs it, such as Supervisor.

Step 4: Verify the Fix

Run both commands below, then compare each result with the patched versions listed above.
Repeat this check for every PHP version on the server.

php8.4 -v
php-fpm8.4 -v

If You Can’t Install the PHP Security Release Yet

PHP states that updating is the only complete fix.
Meanwhile, set session.upload_progress.enabled=0 in php.ini or your FPM pool, then restart every worker.
This blocks the known paths for CVE-2026-109619, but not every possible variant.
Also lower post_max_size, and limit request size at your web server or proxy.
Even so, treat these steps as a short stopgap and patch PHP as soon as you can.

Conclusion

Overall, the PHP security release of 21 October 2026 fixes two critical flaws that affect every PHP web server.
Bagisto needs no new version, so only PHP on your server changes.
Fully managed Bagisto Cloud Hosting plans receive PHP security patches from our team.
If you manage your own cloud server, you must install the PHP security release yourself.
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM and every worker.
Above all, move off PHP 8.1 and older, because the open-source platform can only stay as safe as the PHP beneath it.

Thanks for reading this guide to the PHP security release. If you have any questions, please feel free to comment below or contact our team.

Also you can hire laravel developers for your custom laravel projects. Kindly explore our extensions.