# Ubuntu backports PHP security fixes to 14.04 LTS through 20.04 LTS

> **Key takeaway:** Ubuntu has backported fixes for two critical PHP remote code execution vulnerabilities to end-of-life releases from 14.04 LTS through 20.04 LTS, available via Ubuntu Pro.

**Published:** 2026-10-21T15:33:58+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-backports-php-security-fixes-to-1404-lts-through-2004.html 

## Summary
USN-8948-2 extends the PHP security fixes from USN-8948-1 to older Ubuntu long-term support releases that have reached end of standard support. The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote attackers to execute arbitrary code through crafted network requests. Patched packages are available for Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS, and 14.04 LTS through Ubuntu Pro subscriptions, with 16.04 and 14.04 requiring the Legacy Support add-on.

## Vulnerabilities and affected versions
- **CVE-2026-109618**: PHP incorrectly handles out-of-memory conditions during request processing, leading to potential arbitrary code execution
- **CVE-2026-109619**: PHP fails to properly manage internal request state across worker reuse, enabling arbitrary code execution
- Both vulnerabilities are remotely exploitable through crafted network traffic
- Affected packages span PHP 5.5.9 (14.04 LTS) through PHP 7.4.3 (20.04 LTS)
- Fixes require Ubuntu Pro; 16.04 LTS and 14.04 LTS additionally need the Legacy Support add-on

## Why it matters
Organizations running legacy Ubuntu LTS releases with PHP remain exposed to remote code execution unless they subscribe to Ubuntu Pro. The backport highlights extended security maintenance as a key incentive for paid support on end-of-life systems.