PHP Ships Fixes for Two Critical Unauthenticated-RCE Flaws
The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to address CVE-2026-109618 and CVE-2026-109619. PHP rates both flaws CVSS v4.0 9.2 and says they can allow unauthenticated remote code execution. The project warns that PHP installations serving web requests may be affected, with the highest risk in Apache’s mod_php configuration. [1] The first issue is an…
PHP has released updates for four versions to patch two critical remote code execution flaws. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are rated with a CVSS v4.0 score of 9.2. They can potentially allow unauthenticated remote code execution in PHP installations serving web requests, with Apache’s mod_php configuration being the most at risk.
The issues involve out-of-memory handling and request-owned global state remaining after being freed. PHP asserts these flaws can be exploited before application code runs under mod_php. An external audit and subsequent work by AI-assisted tools and human reviewers helped clarify the impact of the out-of-memory flaw. Despite no confirmed exploit at the time of release, several organizations took precautionary measures, including shutting down public-facing services in multiple countries.
Public-facing services in the Netherlands, Finland, Denmark, and France were offline or in preventive maintenance mode. Approximately 1.5 million of the 2.6 million hosts reported were out of date, though this does not guarantee all were vulnerable or compromised. PHP advises updating as the definitive solution, with older versions no longer receiving support.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.