PHP Releases Emergency Patches for Two Unauthenticated Remote Code Execution Vulnerabilities

On October 21, 2026, the PHP development and security teams released four emergency patch versions to address two critical vulnerabilities that could lead to unauthenticated remote code execution. The currently fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; the project requires PHP operators who handle web requests to promptly verify their deployment and vendor patch status, as these issues occur prior to application code execution.

Two Critical Vulnerabilities and Disclosure Times

The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both assigned CVSS v4.0 scores of 9.2 by PHP, classified as critical. Two official GitHub security advisories were published at 13:34:25 UTC and 13:34:13 UTC respectively, approximately 26 minutes earlier than PHP's previously announced 14:00 UTC release time; these precise timestamps are derived from the metadata of the public GitHub announcements.

CVE-2026-109618 involves request state corruption during memory exhaustion. According to PHP, when allocation failures occur before internal request data is fully initialized, the cleanup process may subsequently treat invalid states as valid states and potentially escalate to remote code execution under specific conditions. This article does not provide actionable request construction, memory layout, or reproduction steps; the key fact for operators to understand is that the issue resides within PHP's own request processing and cleanup workflows, rather than in any application plugin.

Cross-Request State and Deployment Risks

CVE-2026-109619 involves global state left over across requests. PHP states that internal state belonging to one request may persist in the working process after its underlying memory has been released, and subsequent requests might access this stale state before normal initialization is complete, causing use-after-free and ultimately enabling remote code execution. Fatal errors, memory exhaustion, or non-fatal diagnostics may all contribute to forming such state mismatches, but the official announcement does not identify any single configuration as a complete attack condition.

PHP states that all PHP installations processing web requests are in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project ranks mod_php as the highest-risk scenario, as an unauthenticated request path has already been demonstrated to trigger the issue before application code execution begins. Being 'in scope' and having a 'demonstrated exploitation path' does not mean that every installation has already been compromised, nor should this be used to infer that any specific website or data has already been breached.

There are no complete mitigations, updating is the only safe choice.

PHP development team · PHP official emergency security advisory

Stable Versions, Vendor Patches, and Legacy Branches

Complete remediation requires installing PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the current branch. PHP indicates that Linux distributions and long-term support vendors have already received patches in advance, therefore operators obtaining PHP through system software repositories, hosting platforms, or commercial LTS should refer to their respective vendor announcements and package versions. Simply comparing upstream version strings is insufficient to determine whether a distribution has been patched, nor should a vendor update that has not yet been pushed be mistaken for PHP not having released fixes.

PHP 8.1 and earlier branches are no longer receiving regular releases from the PHP project; considering this risk, the project is additionally providing minimal source code patches for PHP 7.4, 8.0, and 8.1 for users who can build themselves or do not have LTS vendors. The official materials used do not provide complete, unified affected matrices for earlier branches, and the pre-release media's claim that PHP 5 through 8 are all affected cannot replace the final official scope. PHP also reminds that PHP 8.2 will reach end-of-life on December 31, 2026, at which point it will stop receiving subsequent project security fixes.

Temporary Mitigations Are Not Complete Remediation

When immediate updates are not possible, PHP lists several measures to reduce exposure, such as disabling session.upload_progress in the server configuration and restarting all worker processes, limiting the size of decoded requests, and disabling fatal_error_backtraces for PHP 8.5. The project also provides temporary recommendations regarding memory limits, upload sizes, and container boundaries, but emphasizes that these measures only cover confirmed paths and cannot restore installations to a secure state. PHP stated in four version announcements: "There are no complete mitigations, updating is the only safe choice."

There are two discrepancies between the pre-disclosure reports and the final announcement that must be preserved: watchTowr provided an initial assessment to BleepingComputer with a CVSS score of 10.0 and a broader version range, while PHP ultimately adopted CVSS v4.0 with a score of 9.2, and released minimal source code patches for the current four fixed versions and three older branches. BleepingComputer referred to researchers not observing in-the-wild exploitation at the time of patch disclosure; however, the final PHP announcement confirmed a remote execution pathway, though the materials used have not been confirmed to have experienced large-scale in-the-wild attacks. Technical exploitability, research reproduction, and actual attack scale in real environments are three distinct issues.

Factual Boundaries and Operational Judgment

Analysis: The urgency of this update stems from an unauthenticated remote code execution vulnerability at the shared runtime layer, rather than a single flaw within a particular framework, thus different applications may share the same underlying exposure surface. For operators, the most reliable sequence of actions is to inventory all Web request entry points, confirm the actual PHP branch and SAPI, consult release or hosting provider announcements, and then verify that updated worker processes have been restarted.

The existing evidence is sufficient to support immediate patching, yet inadequate for estimating the number of compromised sites; translating PHP's prevalence directly into an estimate of the current scale of compromise would exceed current factual boundaries. This also means patching priority can be aligned, while exposure, package versions, and evidence of actual compromise still need to be verified separately.