PHP Critical Security Vulnerability CVE-2026-109618/19: macOS Fix Guide

What Causes This Issue

A pair of critical PHP security vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 have been disclosed, prompting urgent action from developers running PHP on macOS. These flaws affect PHP versions 8.1 through 8.3 and could allow remote code execution or privilege escalation under specific conditions. The vulnerabilities stem from improper input validation in the PHP core parser and a memory corruption issue in the stream wrapper implementation.

Users in the Apple Support Community have reported widespread concern because macOS historically ships with a system PHP binary that often lags behind upstream security releases. While Apple deprecated the built-in PHP in macOS Ventura and removed it entirely in macOS Sonoma, many developers still rely on it for local development, legacy scripts, or CI pipelines. Others use Homebrew, MacPorts, or Docker-based PHP installations that may not have been updated since the advisory dropped.

The core problem: any unpatched PHP runtime exposed to user-supplied data — whether via web requests, CLI arguments, or file operations — represents an attack surface. This is especially relevant for macOS developers running local servers (Laravel Valet, Symfony CLI, built-in PHP server) or processing untrusted files with PHP scripts.

Step-by-Step Fixes

1. Identify every PHP binary on your system. Run which -a php and ls -la /usr/bin/php* /opt/homebrew/bin/php* /usr/local/bin/php* 2>/dev/null to locate all installations. Note the version of each with php -v.
2. Check vulnerability status. Compare each version against the patched releases: PHP 8.1.30, 8.2.24, and 8.3.12 or later. Any version below these is vulnerable.
3. Update Homebrew PHP (most common fix). Run brew update && brew upgrade php. Verify with php -v that you’re on 8.3.12+ (or 8.2.24+ if pinned). Restart any running services: brew services restart php.
4. Update MacPorts PHP. Run sudo port selfupdate && sudo port upgrade php. Select the latest active version with port select --set php php83 (adjust for your version).
5. Rebuild Docker images. If you use Docker for local development, update your Dockerfile base images to php:8.3.12-cli, php:8.2.24-fpm, etc. Run docker-compose build --pull and restart containers.
6. Migrate away from system PHP (if still present). On macOS Monterey or earlier, the /usr/bin/php binary cannot be patched by Apple anymore. Add a Homebrew or MacPorts PHP to your PATH ahead of /usr/bin in your shell profile (~/.zprofile or ~/.bash_profile).
7. Validate the fix. Run a quick test: php -r "echo 'PHP version: ' . PHP_VERSION . PHP_EOL;" and confirm it shows a patched version. Optionally, run your test suite or a static analysis tool (phpstan, psalm) to catch any compatibility issues from the upgrade.

Additional Solutions

Enable PHP’s built-in hardening flags by ensuring your php.ini includes disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source for production-like environments. This limits blast radius if a future vulnerability is exploited.

Use a version manager like phpenv or asdf with the asdf-php plugin. These tools make it trivial to switch between PHP versions and keep them updated with a single command (asdf install php latest). Users in the Apple Support Community have noted this reduces “version drift” across projects.

Audit composer dependencies for abandoned packages that may rely on vulnerable PHP behaviors. Run composer audit and composer outdated --direct to identify packages needing updates or replacements.

Configure automatic security updates for Homebrew with brew autoupdate start --upgrade --cleanup (requires brew tap homebrew/autoupdate). For MacPorts, a daily port selfupdate && port upgrade outdated cron job achieves similar results.

Isolate legacy projects that cannot upgrade PHP immediately using Docker containers pinned to a specific version, with network access restricted to localhost only. This contains risk while you plan a migration.

When to Contact Apple Support

Contact Apple Support only if you encounter a system-level issue directly caused by an Apple-provided component — for example, if a macOS update reinstalls a vulnerable /usr/bin/php binary (unlikely on Sonoma and later) or if Xcode's command-line tools bundle an outdated PHP that breaks your toolchain.

Do not contact Apple Support for:
• Homebrew, MacPorts, or Docker PHP installation issues
• Application-level bugs after upgrading PHP
• General PHP configuration questions
These are upstream or community responsibilities. Apple's scope ends at the OS and its bundled toolchain.

FAQ

Does this affect PHP running in Docker containers? Yes. The vulnerability is in the PHP runtime itself. Any container using a vulnerable base image is exploitable. Rebuild with patched images immediately.

Is the macOS system PHP still supported by Apple? No. Apple removed the system PHP binary in macOS 14 Sonoma. On macOS 13 Ventura and earlier, it receives no security updates. Treat it as end-of-life.

Can I just upgrade the PHP version in my composer.json? That only constrains which version Composer allows. You must still update the actual runtime binary on your machine or in your container.

What if my project requires PHP 8.1 and can't upgrade to 8.2+? Upgrade to PHP 8.1.30, the final patched release in the 8.1 series. It contains only security fixes, no breaking changes. Plan migration to a supported branch (8.2 or 8.3) before 8.1 reaches end-of-life.

How do I verify the CVE patches are actually applied? Check the PHP changelog for your version (php.net/ChangeLog-8.php) and confirm the CVE IDs appear. Alternatively, run a vulnerability scanner like trivy fs . on your project directory.