PHP rushes out critical fixes for remote code execution bugs

PHP has shipped emergency security updates for four supported branches after disclosing two critical remote code execution vulnerabilities affecting web-facing installations.

In a 21 October 2026 security advisory on PHP.net, the PHP project said PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that can allow unauthenticated remote code execution. It urged all PHP users to update immediately.

That is a big deal. PHP still sits under a huge slice of the web, from small sites to major platforms. The project describes it as a “popular general-purpose scripting language” suited to web development, and says it powers everything from blogs to some of the world’s most popular websites.

The affected setups are broad. PHP said all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It assessed the risk as highest for Apache with mod_php, where it said a demonstrated exploit could be triggered by an unauthenticated request before any application code runs.

The first flaw is CVE-2026-109618, described by PHP as remote code execution via out-of-memory corruption. According to the advisory, out-of-memory handling can interrupt PHP while internal request data is only partly initialised. During cleanup, invalid data may then be treated as valid.

The second is CVE-2026-109619, described as remote code execution via stale global state. PHP said request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialisation resets it.

The PHP Foundation, in a separate post published on 21 October, said the vulnerabilities sit in “memory management and error handling”, parts of PHP that nearly every request touches. It said this made the issues serious and difficult to fix without breaking compatibility, hurting performance or forcing changes across third-party extensions.

The Foundation also gave extra background on discovery and handling. It said PHP underwent an external security audit in 2024, funded through the Sovereign Tech Agency and organised through OSTIF, with Quarkslab carrying out the audit. While fixing one issue from that work, a PHP core developer contracted by the Foundation found early signs of the out-of-memory problem behind CVE-2026-109618.

The Foundation said delays in resolving the issue reflected a structural failure, pointing to the security team’s decision process and lack of resources. It said process changes had begun so decisions could be made by majority and compromises encouraged.

Canada’s Cyber Centre, in an alert dated 21 October 2026, echoed the urgency. It described the flaws as use-after-free vulnerabilities and said internet-facing PHP servers and applications are at heightened risk. It also said it had seen open-source reporting that a proof of concept was available, while noting no active exploitation had been identified at that time.

PHP’s advice is simple: move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, although some Linux distributions and long-term support vendors may provide backported fixes.

There are temporary exposure-reduction steps in the PHP advisory, covering memory limits, request size controls, session upload progress and other settings. But PHP is clear that these are not complete mitigations. Updating is the only safe choice.