PHP Security Vulnerabilities: Critical RCE Flaws Demand Urgent Update

Critical PHP security updates are now available. On October 21, 2026, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as security releases, addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable Remote Code Execution (RCE) and pose an immediate, severe risk to many web servers. Update your systems immediately.

The Nature of the Threat: CVE‑2026‑109618 and CVE‑2026‑109619

Both vulnerabilities have been assigned a CVSS v4.0 score of 9.2 and are exploitable without authentication, meaning an attacker does not need any user accounts or credentials to carry out their malicious actions.

CVE-2026-109618: RCE via OOM Corruption

This vulnerability occurs when PHP crashes due to an Out-of-Memory (OOM) condition while request data is only partially initialized. The subsequent request shutdown process then handles this invalid state, which can be exploited. It can be triggered by crafted multipart uploads, for example, with an excessive number of headers per part, empty file fields, or missing Content-Length headers. For Apache mod_php, this vulnerability is particularly critical as it can be exploited before any application code runs. PHP-FPM is also vulnerable according to source code analysis, though a full FPM exploit has not been publicly demonstrated. FrankenPHP is likely affected.

CVE-2026-109619: RCE via Stale Global State

This vulnerability involves a global state of a request that persists in the PHP worker after its memory has been freed. A subsequent request processed by the same worker can then access this freed memory (a “use-after-free” vulnerability), which can lead to Remote Code Execution.

Affected Systems and End-of-Life Risks

All PHP installations that serve web requests (including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed) are potentially affected. Any version below the four fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) is vulnerable. The CERT.at advisory mentions reports of affected PHP versions ranging from 5 to 8, though this remains unconfirmed by the PHP project itself.

For PHP 8.1 and older, the PHP project does not provide official updates. However, the advisory links to minimal source backports for PHP 7.4, 8.0, and 8.1, and Linux distributions and LTS providers received patches in advance. Note that the rpms.remirepo.net repository does not provide updates for this release. Furthermore, PHP 8.2 will reach its End-of-Life on December 31, 2026.

A complete inventory of all PHP installations is essential. This includes not only obvious web servers but also containers, staging environments, and servers operated under a shared hosting model. For all installations running EOL versions (PHP 8.1 and older), an immediate upgrade to a currently supported version is critical, as official patches are not available.

The Update Process

The PHP security team released emergency updates on October 21, 2026, at 14:00 UTC. These include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

The period immediately following the patch release is critical, as exploit code has already appeared online (though its functionality is unconfirmed). CERT.at expects attacks to commence shortly after the release, as exploits can be derived from the patches themselves. Operators should update their systems as quickly as possible. Be aware that there may be delays between the official PHP release and the availability of updated packages in distribution repositories; manual patching may be necessary if immediate updates via package managers are not available.

Addressing these vulnerabilities requires a direct update of the PHP installation at the infrastructure level; it is not a configuration change or an application update that resolves the issue. Before updating, create fresh backups of all your websites and applications.

Temporary Mitigations if Immediate Update is Not Possible

According to php.net, these measures are only partially effective and do NOT replace an update.

; Recommended temporary mitigations (partially effective, do NOT replace an update)

; For CVE-2026-109618 (OOM corruption):
; Set memory_limit to -1, but ensure memory is limited by container/cgroup, not RLIMIT_AS/RLIMIT_DATA.
; Use php_admin_value in FPM pools to prevent applications from overriding.
memory_limit = -1

; Limit maximum POST size and upload file size.
; Adjust based on application needs (e.g., 8M for no uploads, 32M with uploads).
post_max_size = 32M
upload_max_filesize = 28M
; Additionally, limit request sizes at your web server or proxy (e.g., Nginx client_max_body_size).

; For CVE-2026-109619 (stale global state):
; Disable session upload progress. Must be set in php.ini, FPM pool config, or server config,
; NOT via ini_set() or .user.ini. Restart all PHP workers after change.
session.upload_progress.enabled = 0

; For PHP 8.5 only:
fatal_error_backtraces = 0

Actionable Recommendations

The situation demands swift and decisive action:

Inventory Your PHP Installations: Identify all PHP versions running on your servers, in containers, and on staging environments.
Update PHP: Immediately update all vulnerable PHP installations to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a patched package provided by your distribution.
Restart Services: After updating, restart all PHP workers and services (e.g., PHP-FPM, Apache).
Migrate EOL Versions: For systems running PHP 8.1 or older, plan and execute an immediate upgrade to a currently supported PHP version.
Monitor Logs: Pay close attention to your web server and application logs for any unusual multipart requests or suspicious activity.
Backups: Ensure you have current, tested backups before commencing the update process.