PHP releases emergency updates for two critical remote code execution flaws

The PHP project released security updates on October 21, 2026, for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases address two critical vulnerabilities that enable unauthenticated attackers to execute arbitrary code on servers running the scripting language, according to a blog post on thephp.foundation.

The updates fix CVE-2026-109618 and CVE-2026-109619, both of which pose severe risks to server integrity. The PHP Foundation stated that it is imperative for administrators to update immediately. Technical details, including attack vectors and specific update instructions for various systems, are available on php.net.

Context and background

CVE-2026-109618 involves remote code execution via out-of-memory corruption. If a request hits PHP's memory limit at a specific moment, the engine may leave partially initialized internal data behind. This data is later treated as valid, causing memory corruption. On Apache servers using mod_php, an unauthenticated request can trigger this flaw before any application code runs, leading to full remote code execution with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 allows remote code execution via stale state errors. A fatal error occurring at a specific point can leave internal state pointing to memory from a previous request. A subsequent request handled by the same worker may then use that freed memory. Reporters confirmed a use-after-free condition and worker crashes, demonstrating remote code execution against a real-world application running on Apache with mod_php.

Both vulnerabilities reside in core components of PHP, specifically memory management and error handling. Because nearly every request touches these areas, the flaws are serious. Fixing them without breaking compatibility, hurting performance, or forcing changes on third-party extensions proved difficult for the development team.

Who is affected

The issues affect users of PHP versions 8.2 through 8.5. The vulnerabilities were discovered during a 2024 external security audit conducted by

What to do and how to stay safe

• Hardware-backed key storage prevents attackers from extracting credentials even if they gain physical access to the device.
• Mobile device management enforces consistent security policies across diverse operating systems and hardware configurations.
• Application sandboxing limits the damage a compromised app can cause by restricting its access to other data and system resources.

Mobile device security requires a layered approach combining hardware, software, and policy controls. Enable encryption, use strong passcodes, and keep your operating system updated to protect your data.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.