Technology · NEWS EXPLAINER
PHP releases urgent fixes for two critical flaws that can expose web servers
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address two unauthenticated remote-code-execution vulnerabilities. The project says temporary mitigations are incomplete and operators should update now.
The PHP project released four security updates on October 21 for two critical vulnerabilities that can let an unauthenticated attacker execute code on a web server under affected conditions. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The scope is broader than one framework or content-management system: the official advisory covers PHP installations that serve web requests. Operators should inventory the runtime, deploy the appropriate vendor package, restart workers and confirm the running version instead of treating a downloaded package as proof that production is fixed.
Four supported branches received fixes
The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory says every PHP installation serving web requests is in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Both flaws can lead to unauthenticated code execution
CVE-2026-109618 involves corruption during out-of-memory cleanup when request data is only partly initialized. CVE-2026-109619 involves request-owned global state surviving after its backing memory is freed. The project rates both critical and says the demonstrated risk is highest for mod_php.
Updating is the only complete solution
Administrators should use packages from PHP or their operating-system or long-term-support vendor, restart the affected workers and verify the running version. The project lists temporary controls for specific paths, but explicitly says they do not make an installation safe.
Older branches need a vendor or migration decision
PHP 8.1 and older no longer receive normal fixes from the PHP project. Some distributions and LTS vendors may supply backports, and the security team published minimal source backports for PHP 7.4, 8.0 and 8.1, but operators must confirm coverage with their own vendor rather than assume an old runtime is protected.
No observed exploitation is not a reason to wait
Reuters reported that CISA had not observed exploitation at publication time, while still urging immediate updates. Operators took some government sites offline during the response. That disruption does not prove a site was compromised; it shows that taking systems out of service can be part of cautious mitigation when an immediate patch is not possible.
