Summary
PHP released security updates for two critical vulnerabilities that could allow unauthenticated remote code execution on web-facing installations. The project urges users to update to the fixed releases.
The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that could allow unauthenticated remote code execution. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project urges users to update immediately.
The advisory covers PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says the risk is highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before application code runs.
How the vulnerabilities work
CVE-2026-109618, described as remote code execution through out-of-memory corruption, involves PHP’s handling of memory exhaustion. An out-of-memory condition can interrupt processing while internal data for a request is only partly initialized. During cleanup, PHP may then handle that invalid data as if it were valid.
CVE-2026-109619 involves stale global state. Internal state associated with one request can remain after the memory supporting it has been freed. If the same worker handles another request, it may use that stale state before normal initialization resets it. The PHP advisory identifies both issues as potential paths to remote code execution.
Fixed versions and immediate steps
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as applicable. Linux distributions and long-term-support vendors received the patches in advance, so installations using vendor packages should check for the corresponding updated package.
PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes; the project also supplied minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source or without access to an LTS vendor. PHP 8.2.35 includes these fixes, but PHP 8.2 reaches end of life on 31 December 2026.
The project lists temporary configuration measures that can reduce exposure to particular attack paths, including disabling session upload progress for one of the vulnerabilities. It describes these measures as incomplete: updating is the only safe choice.