PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: patches for two critical unauthenticated RCEs

The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution without authentication. Anyone running PHP web servers must update immediately: the disclosure comes from Wordfence, but the full technical details are in the official advisory published on php.net.

What the two CVEs say

According to the official php.net advisory, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow remote code execution without authentication. The project states that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that the risk is considered higher for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code is executed.

The two flaws, as described by PHP: the first, CVE-2026-109618, is an RCE via OOM corruption: memory exhaustion handling can interrupt PHP while internal request data is only partially initialised, and subsequent cleanup can treat that invalid data as valid. The second, CVE-2026-109619, is an RCE via residual global state: the internal state associated with a request can survive after the underlying memory is freed, and a subsequent request handled by the same worker can use that residual state.

What to do

The indication from PHP is clear: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Versions 8.1 and earlier no longer receive updates from the PHP project, although some distributions and LTS vendors provide backported fixes; given the severity, the PHP security team has nevertheless provided minimal backports from source for PHP 7.4, PHP 8.0 and PHP 8.1 for those compiling from source or without access to an LTS vendor.

For those unable to update immediately, PHP indicates temporary mitigations that reduce exposure but do not close the vulnerability: for CVE-2026-109618, set memory_limit=-1, preferably in a way that applications cannot override it, alongside limiting post_max_size; for CVE-2026-109619, set session.upload_progress.enabled=0 and restart every worker, and on PHP 8.5 also set fatal_error_backtraces=0 and restart every worker.

On the long-term support front, the official supported versions page indicates for the 8.2 branch security support until 31 December 2026, for 8.3 until 31 December 2027, for 8.4 until 31 December 2028 and for 8.5 until 31 December 2029: anyone still on 8.2 has less than two months before full support ends.