Critical PHP Security Update: Two Unauthenticated RCE Vulnerabilities Fixed

On October 21, 2026, the PHP development team issued urgent security updates for their PHP 8.5, 8.4, 8.3, and 8.2 software versions. These updates are vital because they address two critical vulnerabilities that could allow remote code execution (RCE) without requiring any authentication.

PHP is a widely-used scripting language for web development, running on web servers, in command-line environments, and on various platforms. If you maintain a PHP application or manage a server that processes PHP code, updating to the latest patched versions is strongly recommended.

The official security advisory notes that the vulnerabilities could enable an attacker to take control of the server and execute arbitrary code. This is particularly dangerous since the issues do not require valid user credentials to exploit.

There are two separate security flaws:

1. CVE-2026-109618: This vulnerability stems from memory corruption issues that arise when PHP cannot allocate sufficient memory during request processing. Under certain conditions, PHP may mishandle partially initialized request data, potentially leading to code execution.

2. CVE-2026-109619: This issue involves improper handling of request-specific internal state. In vulnerable scenarios, certain state data associated with a request could persist beyond the request's lifecycle, leading to use-after-free-like conditions that can also result in remote code execution.

To mitigate these threats, PHP users should immediately update to the corresponding patched versions:

- PHP 8.5 users should upgrade to 8.5.12

- PHP 8.4 users should update to 8.4.27

- PHP 8.3 users should apply 8.3.36

- PHP 8.2 users should install 8.2.35

These patches resolve the vulnerabilities and provide a complete fix. Configuration changes alone cannot fully address the security risks, as the core issues lie in PHP's internal handling of memory and request state.

It's important to upgrade to the version matching your current PHP release branch. The PHP team advises taking prompt action, as these vulnerabilities can be triggered without proper user authentication.

For further details on the vulnerabilities, supported updates, and configuration recommendations, refer to the complete PHP Security Advisory released on October 21, 2026.