PHP patches released for two critical RCEs

The PHP project has published PHPversions 8.5.12,8.4.27, 8.3.36 and 8.2.35 to addresstwo critical vulnerabilities that could allow unauthenticated remote codeexecution.

Who is at risk: all PHP installations serving web requests,including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Weconsider the risk highest for mod_php, with a demonstrated exploit where anunauthenticated request can trigger the attack before any application coderuns.

The vulnerabilities:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memoryhandling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-ownedinternal state can survive after its backing memory has been freed. A laterrequest handled by the same worker may use that stale state before normalinitialization resets it.

PHP versions older than 8.1 will not receive updates from the project, thoughthe project has provided some patches for PHP7.4, PHP8.0, and PHP8.1 to assist in creating backports. According to theannouncement, Linux distributions and vendors received patches in advance, soupdated packages should be coming soon.