PHP patches released for two critical RCEs

The PHP project has issued updates to versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that could enable unauthenticated remote code execution. All PHP installations serving web requests, such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, are affected. The highest risk is associated with mod_php, as an unauthenticated request can trigger the attack before any application code is executed.

The vulnerabilities involve two types of remote code execution (RCE). The first vulnerability, CVE-2026-109618, allows for RCE via out-of-memory (OOM) corruption. When PHP handles an out-of-memory situation, internal request data may be improperly initialized. During request cleanup, this invalid data can be treated as valid by the system.

The second vulnerability, CVE-2026-109619, relates to RCE via stale global state. Internal request state can persist even after its associated memory has been freed, potentially being used by subsequent requests before normal initialization occurs.

PHP versions earlier than 8.1 will not receive direct updates from the project. However, the project has supplied patches for PHP 7.4, 8.0, and 8.1 to help developers create backports. Linux distributions and vendors have been provided with pre-updates, so newer package versions should be available soon.