New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released fixes for two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Updating PHP is the only way to regain security. Do it now.

More news.

Good explanations.

Tags: patching, vulnerabilities

Posted on October 22, 2026 at 9:26 AM • 4 Comments

Comments

Clive Robinson • October 22, 2026 10:07 AM

Sent in parts due to auto-mod at 14:00UTC

Part 1,

@ Bruce, ALL,

A search Gave the following information,

“The critical PHP vulnerabilities were discovered by the cybersecurity firm Calif … and independently by researchers at Wiz”

If this is correct then the vulnerabilities were found by the use of AI systems.

Clive Robinson • October 22, 2026 10:09 AM

Part 2,

I could list another series of “AI Vulnerability Discoveries” but the list would be fairly lengthy…

Many have been dismissed as “slop” but sufficient have not to be of considerable concern.

These non slop AI findings have the feeling of being found at a rapid rate that is outstripping developers ability to fix them in a timely fashion.

I don’t know if anyone is keeping figures on this but it appears to be rattling lots of people including UK politicians (which is not good).

Thus I’m worried that ill advised precipitous political actions will be taken and we will suffer for a considerable period because of them.

Perry • October 22, 2026 10:28 AM

“Updating PHP is the only way to regain security.”

Updating PHP is the only way to mitigate these vulnerabilities, but doing so does NOT make PHP “secure.”

In fact, that train of thought borders on magical thinking. Because beyond on a shadow of doubt there exist other severe issues in PHP that have simply not been discovered.

Clive Robinson • October 22, 2026 10:36 AM

@ ALL,

The BBC is running a news “live update” on the PHP issue,

https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

It reports that 32 UK Gov sites are effected but as of yet, nobody has reported being attacked in the UK…

I would take that with a grain of salt about the size of Lott’s Wife …

There is however other news that is equally as worrying…

Indian Certificate Authority eMudhra has used rediculous signing key values for it’s top level certificates.

Thus something like 60million certificates are now garbage and it will be easily possible for anyone to fake certs that most browsers will accept untill the browsers and other Apps have been correctly updated (which they may never ve in the case of embedded systems such as consumer Routers and IoT devices…

You can read an Outraged at this article,

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

There is however an ironically funny side to it… One of the PK cert values was “4” which many probably remember from a XKCD joke on a random number generator.

Have a look on the Current Friday squid for more on this,

https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html/#comment-459121

So two very serious security issues this week, and as the old saying has it,

“It’s not even over yet…”

Schneier on Security

New Serious PHP Vulnerabilities Released and Patched

Comments

Leave a comment Cancel reply