Summary
PHP released updates across four version branches to fix two critical vulnerabilities that could allow unauthenticated remote code execution under specific conditions. The PHP Foundation says the incident also prompted changes to the project’s security staffing and decision-making processes.
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, fixing two critical vulnerabilities that could allow unauthenticated attackers to execute code on servers under the right conditions. The PHP Foundation says the flaws affected core memory-management and error-handling paths, and urges PHP operators to update.
Two flaws in core request handling
CVE-2026-109618 involves memory corruption after an out-of-memory condition. If a request reached PHP’s configured memory_limit at a particular point, partially initialized internal data could be left behind and later treated as valid. On Apache with mod_php, an unauthenticated request could trigger the condition before application code ran; the Foundation says full remote code execution was demonstrated with default settings. Remote code execution was also confirmed through application-level paths on PHP-FPM.
CVE-2026-109619 involves stale state after a fatal error. In the reported scenario, internal state could continue to refer to memory from a previous request. A later request handled by the same worker could use that freed memory. A use-after-free and worker crash were confirmed, and a researcher demonstrated remote code execution against a real-world application running Apache with mod_php.
The vulnerabilities had different triggering paths, but both affected parts of PHP that nearly every request uses. The Foundation says that made fixes difficult to balance against compatibility, performance and the needs of third-party extensions. The updates are available across the four PHP branches named in the release.
A larger security effort—and a difficult fix
The Foundation traces the first signs of the out-of-memory issue to work following a 2024 external security audit by Quarkslab, organized through the Open Source Technology Improvement Fund with funding from the Sovereign Tech Agency. At that time, a possible exploit had been theorized, but no concrete attack path had been found. The Foundation says attempts to choose a fix stalled and restarted over months because the options carried significant trade-offs and the small group of developers with deep engine expertise had competing responsibilities. It describes the delay as a structural failure and says the security team is changing its consensus-based decision process to allow majority decisions and encourage compromises.
The full impact became clearer after Calif reported an unconditional remote code-execution path on August 11, 2026. OpenAI reported the same root cause that day; Wiz reported another attack vector on August 24, and OpenAI reported further vectors on September 18. The Foundation says fixing the out-of-memory issue became its security team’s top priority once those reports showed its impact.
PHP’s security work has also gained staff and new tools. The Foundation created an Ecosystem Security Team in May 2026 to support triage, coordination and hardening. It describes using Anthropic’s Claude Mythos to scan PHP, and adding OpenAI’s Daybreak Red to help validate reports and exploits, alongside sanitizer builds and reproduction environments. The Foundation says tools help validate and group reports, but people make the decisions and work on patches. Since July 1, it says, the team has published 15 CVEs and handled more than 100 reports that were invalid, duplicates or could not be reproduced.
The coordinated release was brought forward by one day after the CVE identifiers began circulating online on October 20. The Foundation says distributors had received patches in advance so users could update promptly when the fixes were disclosed. It presents the expanded team and changing decision process as ongoing work intended to help resolve similarly complex vulnerabilities faster.