Artificial Intelligence · Cybersecurity
PHP patches two critical remote code execution flaws
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities that could allow unauthenticated remote code execution across common web deployment modes, and urged immediate updating.
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed two critical vulnerabilities that could allow unauthenticated remote code execution.
- The advisory said all PHP installations serving web requests were at risk, with the highest risk in mod_php and a demonstrated exploit before application code started.
- The issues were tracked as CVE-2026-109618 and CVE-2026-109619, and the advisory described them as an out-of-memory corruption flaw and a stale global state flaw.
- The PHP security team said Linux distributions and LTS vendors had received patches in advance, and it supplied minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1.
PHP said versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixed two critical flaws that could let an unauthorised attacker run code remotely. It told users to move to those releases as soon as possible.
The advisory said any PHP deployment serving web requests could be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It said the greatest risk was in mod_php, where a demonstrated exploit could run before application code began.
One issue was labelled CVE-2026-109618 and described as an out-of-memory corruption bug. The other, CVE-2026-109619, was described as a stale global state problem that could let later requests use freed internal data.
For people unable to patch at once, the advisory listed steps that could reduce exposure to specific paths, including changes to memory and upload limits, disabling session upload progress in some setups, and fixing fatal errors and timeouts. It also said distribution and LTS vendors had already received patches, and that the PHP security team had provided minimal backports for PHP 7.4, PHP 8.0 and PHP 8.1.
Named in this story
Organisations
- PHP security team
- issued the advisory and provided backports for older branches
Products and systems
- PHP
- released the patched versions and published the advisory
- mod_php
- was identified as the highest-risk deployment mode
- PHP-FPM
- was listed among the affected request-serving setups
- Apache
- was named in affected Apache with mod_php deployments
- FrankenPHP
- was named among the affected web-request serving setups
- LiteSpeed
- was named among the affected web-request serving setups
- CVE-2026-109618
- was the out-of-memory corruption flaw
- CVE-2026-109619
- was the stale global state flaw
- rpms.remirepo.net
- was the volunteer-maintained repository the advisory said would not update that day
How the source tells it
A technical security advisory with urgent patch guidance, but no distinct emotive framing beyond standard mitigation language.
No emotive framing was found in the original.