PHP releases patches for two critical vulnerabilities

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical security flaws. It told users to update straight away.

The advisory said the affected setups included PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It said mod_php carried the highest risk because a request could hit the flaw before application code began to run.

The first issue, CVE-2026-109618 and GHSA-w8hw-w9fx-j79w, involved memory exhaustion interrupting initialisation, which could leave request data in a half-set state. The second, CVE-2026-109619 and GHSA-6wmf-4rv5-p3rp, involved request state surviving after its memory had been freed, so a later request in the same worker could use it.

The project said Linux distributions and LTS vendors had already received the fixes. It also said PHP 8.1 and older no longer got updates from the project, though some vendors backported fixes, and it offered minimal source backports for PHP 7.4, 8.0 and 8.1.

For people who could not update immediately, the advisory listed measures that reduced exposure to particular attack paths but did not make an installation safe. It also said the volunteer-maintained rpms.remirepo.net repository would not have updates that day.