The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch first, then restart PHP-FPM or your web server.
Patching won't help a server that was already broken into, and some servers can't be patched at all. This post explains what Zentera can and can't do in those cases.
If your web server is public, Zentera can't block this attack. The attacker only needs to send an HTTP request to the site, and any PHP page will work.
Zentera also can't stop an attacker from stealing data the web server can read. Once they can run code, they can send files, passwords and database records back to themselves in a normal web page. CVE-2026-109618 can also leak the server's memory directly, even without running code.
To block the attack itself, patch PHP. A WAF rule or turning off session.upload_progress.enabled can help in the short term, but only partly.
A successful attack lets the attacker run code on the web server. Zentera limits where they can go from there.
Keep the attacker on that server. Zentera only lets the web server connect to the systems and ports it needs. The attacker can't log in to the database server over SSH, reach file servers or domain controllers, or move anywhere else on the network.
Zentera's application interlock can also lock database access on port 3306 to the PHP program. Other programs the attacker runs, like their own database client, are blocked. This exploit runs the attacker's code inside PHP, though, so that code can still use the database connection.
Block outbound connections. Attackers usually make the server connect back to them. They use this to open a remote shell, download more tools, run crypto miners or copy out large amounts of data. A web server rarely needs to start connections to the internet, so Zentera can block them. Zentera can also block programs the attacker starts, like curl, nc or a shell. It can't block code running inside PHP itself, because that has to be allowed for the web server to work.
Make stolen passwords less useful. An attacker who steals database or service passwords still needs to reach those systems. Systems protected by Zentera can't be reached from outside, so the passwords only work from the compromised server, through the connections it already has. This doesn't protect SaaS or cloud API keys.
Alert on suspicious activity. When a compromised web server tries to connect somewhere new, Zentera blocks the connection and logs it. Send those logs to your SIEM, because they are a strong sign of a break-in. You can also cut the server off with a single policy change.
Zentera helps even more in two cases.
Internal applications. Many PHP applications are only for employees: admin consoles, phpMyAdmin, monitoring dashboards, intranet sites and device management pages. Zentera can hide these from the network so only approved users and devices can reach them. An attacker would need valid access before they could even try this exploit.
Old PHP versions. PHP will not fix versions 8.1 and earlier. Many embedded systems and OT devices run old PHP in their web interfaces, and they will stay vulnerable for years. These devices often can't run an agent, so Zentera protects them with a gateway that controls who can reach them.
Patching is the fix. For servers that are already compromised or can't be patched, Zentera limits what an attacker can do next.