On October 21, 2026, the PHP development team issued a critical security advisory alongside new patch releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases address two critical vulnerabilities that allow unauthenticated remote code execution (RCE). All PHP users are strongly urged to update as soon as possible.
Who Is at Risk?
All PHP environments serving web requests are vulnerable, including setups using:
- PHP-FPM
- Apache with mod_php (carries the highest risk, with a confirmed exploit demonstrating that an unauthenticated request can trigger code execution before any application code even runs)
- php-cgi
- FrankenPHP
- LiteSpeed
Details of the Vulnerabilities
Vulnerability ID | Type | Technical Overview |
CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) | RCE via OOM corruption | Out-of-memory (OOM) handling can interrupt PHP execution while internal request data is only partially initialized. During request cleanup, PHP may treat this corrupted/invalid data as valid, leading to memory corruption. |
CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) | RCE via stale global state | Request-owned internal state can persist even after its underlying memory has been freed. A subsequent request handled by the same worker process may access this stale state before the routine initialization cycle properly resets it. |
Recommended Remediation (Apply Immediately)
Applying official security patches is the only complete and reliable solution:
- Upgrade to Patched Versions:
- PHP 8.5 PHP 8.5.12
- PHP 8.4 PHP 8.4.27
- PHP 8.3 PHP 8.3.36
- PHP 8.2 PHP 8.2.35 (Note: PHP 8.2 reaches End-of-Life on December 31, 2026).
- Linux Distributions & LTS Vendors:
- Major distributions and enterprise LTS vendors received advance notice; check your system package manager (e.g., apt, dnf, yum) for updated packages.
- Users relying on volunteer-maintained repositories like Remi (rpms.remirepo.net) are urged to switch to distribution packages or build directly from source, as updates may be delayed.
- PHP 8.1 and Older Releases:
- These branches have reached End-of-Life (EOL) upstream. However, given the severity of these issues, the PHP security team has provided minimal source backports for PHP 7.4, 8.0, and 8.1 to assist administrators compiling from source or operating without access to an LTS provider.
Temporary Mitigations (If Immediate Upgrades Are Not Possible)
Disclaimer: These workarounds only reduce the attack surface for specific vectors and do not guarantee complete security.
Mitigations for CVE-2026-109618 (OOM Corruption)
- Set memory_limit = -1 via directives that applications cannot override (such as php_admin_value in the FPM pool or Apache configuration) to eliminate controllable internal memory limit triggers.
- Restrict post_max_size:
- If your workload does not require file uploads, set post_max_size = 8M.
- If file uploads are needed, set post_max_size = 32M and keep upload_max_filesize strictly lower than post_max_size.
- Enforce strict perimeter limits at the reverse proxy or web server layer (e.g., Nginx, Cloudflare) for decoded body size, input field count, multipart part count, header count, and nesting depth.
- Use container or cgroup resource boundaries with policies configured to terminate individual misbehaving workers rather than using RLIMIT_AS or RLIMIT_DATA.
Mitigations for CVE-2026-109619 (Stale Global State)
- Disable upload progress by setting session.upload_progress.enabled = 0 globally inside php.ini or FPM pool configuration (avoid relying on ini_set() or .user.ini), then restart all worker processes.
- On PHP 8.5, configure fatal_error_backtraces = 0 and restart workers.
- Clean up invalid or deprecated runtime options evaluated on a per-request basis that emit warnings prior to proper request initialization.