PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update

All PHP installations serving web requests must be updated immediately to patch critical remote code execution vulnerabilities.

On October 21, 2026, the PHP project released security updates for multiple versions, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, to address two critical, unauthenticated remote code execution (RCE) vulnerabilities. These flaws, identified as CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), affect all PHP installations serving web requests, such as those using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is considered highest for mod_php installations, where an exploit can trigger the vulnerability before application code execution. The PHP security team strongly urged all users to update immediately, as no complete mitigations exist. Minimal backported fixes were provided for PHP 7.4, 8.0, and 8.1 for users unable to upgrade to supported versions.

The widespread impact of these two RCE vulnerabilities highlights the critical importance of timely patching across all PHP deployments. The nature of the vulnerabilities, one exploiting memory corruption during out-of-memory handling and the other leveraging stale global state across requests, suggests a need for deeper scrutiny of PHP's internal request lifecycle management. Developers and system administrators must prioritize immediate updates, as unpatched systems are at extreme risk of compromise, potentially leading to significant data breaches or service disruptions.

This incident serves as a stark reminder for the wider web development ecosystem about the ongoing threats posed by unauthenticated RCE flaws. Organizations heavily reliant on PHP will face urgent operational challenges to ensure all instances are updated, especially those with complex or legacy configurations. The PHP project's recommendation for immediate updates and the lack of complete workarounds emphasize the severity and the essentiality of proactive security maintenance for all web servers running PHP.