Proxmox VE’s default installation is not affected by PHP vulnerabilities: PHP is not installed by default, and neither pveproxy nor other Proxmox VE functions use PHP. Two current CVE's are 

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.

RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

and unless someone has installed PHP to support another service they are not in scope.

Verify

To check whether PHP has been installed separately, run:

apt list --installed 'php*'

If no PHP packages are listed, PHP vulnerabilities are out of scope for the Proxmox host. If packages appear, PHP was installed separately, usually to support a third-party service. Identify what depends on it before deciding what to do.

PHP used only as a command-line interpreter is rarely exposed to remote web-based attacks, although it should still be kept up to date. Risk can be higher when PHP is connected to a web server. Check whether Apache, Nginx or Lighttpd is running, and whether PHP-FPM or another PHP handler is configured:

systemctl --type=service --state=running

If PHP supports a service, assess its purpose and exposure, then patch PHP and the service that uses it, or remove PHP if it is no longer needed.

Guests

It's entirely possible that your guests are running php, so that is a far larger exercise to evaluation and patch as needed, and goes beyond the scope of this article which is proxmox specific. If you need help classifying and patching, the HelpDesk is here to help.