PHP issues emergency fixes for two critical remote-code-execution flaws

The PHP project has released emergency updates for two critical vulnerabilities that can allow unauthenticated remote code execution. The fixes arrived on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both issues, tracked as CVE-2026-109618 and CVE-2026-109619, received a critical score of 9.2 out of 10 under CVSS 4.0.

The official advisory considers every PHP installation serving web requests to be at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The most severe demonstrated scenario involves mod_php, where an unauthenticated request can trigger the attack before application code runs. Updating WordPress, Drupal or another PHP application therefore does not replace patching the runtime on the server.

Two flaws with different paths

CVE-2026-109618 involves memory corruption during out-of-memory handling. According to the project, PHP can interrupt a request while internal data is only partially initialized; later cleanup may treat that invalid data as legitimate. CVE-2026-109619 allows request-owned internal state to survive after its backing memory has been freed, creating a risk when the same worker handles a later request.

Both flaws can lead to remote code execution, but they do not necessarily depend on a vulnerability in a website or plugin. That distinction changes the operational priority: administrators need to verify the version actually running on the server, not only the CMS version or major PHP branch shown in a control panel. Being on PHP 8.5, for example, is not enough if the installation is older than 8.5.12.

PHP 8.1 and earlier branches no longer receive regular updates from the PHP project. Some Linux distributions and long-term-support vendors provide backported fixes, and the security team published minimal source backports for PHP 7.4, 8.0 and 8.1. In those cases, the package number may not match the official list directly, making the vendor advisory the relevant reference.

Updating is the only complete fix

The PHP project published temporary steps, including memory-limit changes and disabling session upload progress, but says those measures block only known paths. The recommendation is to install patched packages; when that cannot be done immediately, CERT-EU advises organizations to consider isolating internet-facing applications until the update has been applied and verified.

Amazon says it identified an exploitation attempt in its MadPot sensor network on October 17, four days before public disclosure. The company also observed other attempts and proof-of-concept code before the embargo ended, followed by broad activity after the fixes were published. AWS said, however, that it was unclear whether the earlier attempts would have worked against real-world systems. The confirmed fact is detected malicious activity; that report did not establish compromises at specific organizations.

The practical consequence is that response time should be measured in hours rather than routine maintenance cycles. Checking the installed package, confirming the source of the fix and restarting PHP workers when required matter more than relying only on application filters or an external protection layer.