PHP fixes two critical remote code execution flaws, update now

PHP fixes two critical remote code execution flaws, update now

21 October 2026: The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can let an attacker who is not logged in run code on a server. Every PHP installation that serves web requests is at risk, PHP has demonstrated an attack against mod_php that fires before any application code runs, and it tells all users to update immediately.

Not yet independently verified. PHP has not said whether either flaw is being exploited; the exploit it describes is its own demonstration. The CVSS score of 9.2 comes from its notice of 20 October rather than the release advisory. We will update this when it can be confirmed, and remove this note.

Fixed versions

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35

PHP 8.1 and older no longer get releases from the project. Given the severity, its security team has published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source, and some Linux distributions and long-term support vendors carry their own fixes.

Two ways into the same worker

CVE-2026-109618 turns on out-of-memory handling: running out of memory can interrupt PHP while internal request data is only partly set up, and cleanup then treats that half-built data as valid. CVE-2026-109619 is about state that outlives its request: data owned by one request can survive after its memory has been freed, and a later request handled by the same worker can use it before normal set-up resets it. Both are tracked as GitHub security advisories (GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp) with the full technical detail.

PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as exposed. It had announced the release a day early, scoring both flaws 9.2 under CVSS 4.0 and reserving the right to ship sooner if details leaked, and it published on 21 October shortly before the 14:00 UTC slot it had set. The UK's NCSC told organisations that cannot patch to consider taking affected systems offline.

Where the packages come from

Linux distributions and LTS vendors received the patches in advance, so their updated packages are the first place to look on a managed server. PHP singles out one popular source: anyone relying on the volunteer-run rpms.remirepo.net repository is urged to move to distribution packages or build from source, because that repository will not have updates on release day. Shared and managed hosting customers depend on their provider, and the useful question to ask is which of the four versions their account now runs; we list 200 firms in our web hosting category.

Stopgaps PHP itself calls incomplete

Only the update fixes both flaws, and PHP says its interim settings reduce exposure without making a server safe:

• for CVE-2026-109618, set memory_limit=-1 where applications cannot override it, keep post_max_size low (8M without uploads, 32M with them), enforce request size and field limits at the web server or proxy, and rely on container or cgroup limits rather than RLIMIT_AS or RLIMIT_DATA, which can trigger the flaw
• for CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or the pool configuration (not ini_set() or .user.ini) and restart every worker; on PHP 8.5, also set fatal_error_backtraces=0

PHP adds that hiding errors with display_errors or @ does not help, and that attacker-reachable fatal errors and timeouts in uploads, imports and callbacks are part of the second flaw's path.

Related on TrustList:

• Craft CMS sites need 5.11.0 or 4.18.8 to close Twig sandbox code flaws
• CERT/CC says ten Thelia 2.6 flaws are unpatched; Thelia ships 3.2.1

Sources

• PHP: Security advisory: Critical remote code execution vulnerabilities, update now, 21 October 2026
• PHP: Upcoming Critical PHP Security Release, 20 October 2026
• NCSC: Critical security issue affecting PHP, 21 October 2026