Today's PHP security release, and how we're strengthening security

PHP installations now have critical remote code execution vulnerabilities fixed, requiring immediate updates to prevent server compromise.

The PHP Foundation released critical security updates for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. These updates address two severe vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthenticated attackers to execute code remotely on servers. The vulnerabilities stem from issues in memory management and error handling, parts of PHP that are accessed by nearly every request. One vulnerability, related to out-of-memory corruption, could enable remote code execution on Apache with mod_php under default settings, and was also confirmed on PHP-FPM through application code. The second vulnerability involves a use-after-free condition in worker processes handling previous requests, also leading to remote code execution. These critical fixes require immediate updating by all PHP users. The Foundation highlighted ongoing efforts to improve PHP's security posture, including external audits and increased staffing for security triage and hardening.

The PHP Foundation's announcement signals a significant maturation in how the project handles critical security vulnerabilities, moving from a historically resource-constrained, consensus-driven model to a more professionalized, funded security operation. The involvement of external auditors like OSTIF, Quarkslab, Calif, OpenAI, and Wiz, coupled with dedicated internal hires for security, indicates a proactive approach to identifying and fixing deeply embedded issues. This shift is crucial given PHP's widespread use across essential web infrastructure.

The Foundation's efforts to streamline decision-making, encourage compromise, and leverage AI for report validation underscore a commitment to faster, more robust security responses. The incident of a premature leak and the subsequent challenges in coordinated disclosure highlight the complexities of securing a foundational technology used by millions, necessitating continued investment and organizational support from dependent entities.