{
  "id": 15896079,
  "title": "PHP patches released for two critical RCEs",
  "url": "https://urgent.news/2026/10/21/php-patches-released-for-two-critical-rces",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T13:53:18.000Z",
  "source": {
    "name": "LWN",
    "slug": "lwn",
    "url": "https://lwn.net/Articles/1102014/"
  },
  "original_language": "en",
  "account": "The PHP project has issued updates to versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that could enable unauthenticated remote code execution. All PHP installations serving web requests, such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, are affected. The highest risk is associated with mod_php, as an unauthenticated request can trigger the attack before any application code is executed.\n\nThe vulnerabilities involve two types of remote code execution (RCE). The first vulnerability, CVE-2026-109618, allows for RCE via out-of-memory (OOM) corruption. When PHP handles an out-of-memory situation, internal request data may be improperly initialized. During request cleanup, this invalid data can be treated as valid by the system. The second vulnerability, CVE-2026-109619, relates to RCE via stale global state. Internal request state can persist even after its associated memory has been freed, potentially being used by subsequent requests before normal initialization occurs.\n\nPHP versions earlier than 8.1 will not receive direct updates from the project. However, the project has supplied patches for PHP 7.4, 8.0, and 8.1 to help developers create backports. Linux distributions and vendors have been provided with pre-updates, so newer package versions should be available soon.",
  "summary": "The PHP project has published PHP versions 8.5.12 , 8.4.27 , 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code execution. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an…",
  "key_points": [
    "PHP releases patches for two critical RCE vulnerabilities",
    "Vulnerabilities enable unauthenticated remote code execution",
    "Affected PHP installations include PHP-FPM, Apache, php-cgi"
  ],
  "editors_take": "The vulnerability in modphp places web servers at immediate risk by allowing unauthenticated attackers to execute code before any application security measures can even begin to run.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}