PHP releases urgent security patches for critical remote code execution flaws

The PHP project has released immediate security updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities. These flaws allow unauthenticated attackers to execute arbitrary code on servers running PHP under specific conditions. The release follows a coordinated disclosure effort that was partially disrupted by early leaks of vulnerability identifiers.

What happened

The updated releases patch CVE-2026-109618 and CVE-2026-109619, both of which carry high severity ratings. The first vulnerability involves remote code execution via out-of-memory (OOM) corruption. If a request hits PHP’s memory limit at a precise moment, the engine may leave partially initialized internal data in memory. Later operations can treat this data as valid, leading to memory corruption. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, enabling full remote code execution even with default settings. Researchers also confirmed exploitation paths through PHP-FPM via application-level code.

The second vulnerability stems from stale global state handling. A fatal error occurring at a specific point can leave internal pointers referencing memory freed from a previous request. Subsequent requests handled by the same worker process may access this freed memory, resulting in use-after-free errors, worker crashes, and potentially remote code execution. This was demonstrated against real-world applications running on Apache with mod_php. Both issues reside in core components touched by nearly every request, making them particularly dangerous and difficult to fix without impacting performance or breaking compatibility with third-party extensions.

How it works

These vulnerabilities exploit fundamental aspects of PHP’s memory management and error handling systems. In the OOM scenario, the engine fails to cleanly reset its internal state when memory limits are reached. Instead of halting safely, it leaves behind corrupted structures that subsequent operations misinterpret as valid data. This allows an attacker to manipulate memory layout by triggering memory exhaustion at strategic points, eventually gaining control over execution flow.

The stale global state issue arises from how PHP manages resources across multiple requests within the same worker process. When a fatal error occurs, cleanup routines may not fully invalidate pointers to previously allocated memory. If a new request reuses these dangling pointers, it accesses invalid memory regions. Attackers can craft sequences of requests that trigger these errors and then exploit the resulting memory confusion to inject and execute malicious code. Because these mechanisms are central to PHP’s operation, fixing them required careful balancing of safety, performance, and backward compatibility.

Key details

• Affected versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes; older unsupported versions remain vulnerable.
• CVE-2026-109618: Remote code execution via out-of-memory corruption, exploitable on Apache/mod_php without authentication.
• CVE-2026-109619: Remote code execution via stale global state and use-after-free, confirmed on Apache/mod_php.
• Disclosure disruption: CVE IDs leaked on October 20th, prompting an accelerated release schedule from October 22nd to October 21st.
• Research contributors: Calif, OpenAI, Wiz, and Trail of Bits identified and reported the vulnerabilities through responsible disclosure channels.
• Root cause history: The OOM issue was initially theorized in 2024 but lacked a concrete exploit vector until recent AI-assisted research clarified the attack path.

Why it matters

For teams maintaining PHP applications, these vulnerabilities represent a significant risk because they can be triggered without authentication and affect core engine behavior. The fact that exploitation is possible on default configurations means many production environments are exposed until patched. The complexity of the fixes highlights the technical debt accumulated in long-standing projects like PHP, where changing memory management logic risks breaking countless third-party extensions and existing applications.

The incident also underscores the evolving landscape of software security research. AI-assisted tools played a major role in identifying and validating these vulnerabilities, accelerating the discovery process compared to traditional manual auditing. However, this same technology increases the volume of reports security teams must triage, including many invalid or duplicate submissions. The PHP Foundation’s recent investments in professional security staff and automated tooling were crucial in managing this influx and delivering timely patches, demonstrating the need for sustained funding in open-source infrastructure security.

What you can do

• Update your PHP installations to version 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately depending on your current branch.
• Verify that your deployment pipeline can automatically pull these updated versions from your package manager or distribution repository.
• Review server logs for unusual memory exhaustion events or fatal errors that might indicate attempted exploitation prior to patching.
• Consider sponsoring the PHP Foundation if your organization relies on PHP, as their work directly supports the security and stability of the ecosystem.
• Monitor official PHP channels for any further advisories, as the recent leak may have accelerated the development of public proof-of-concept exploits.
• Evaluate your use of mod_php versus PHP-FPM, as the attack vectors differ slightly between these configurations, though both are affected.