New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released fixes for two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Updating PHP is the only way to regain security. Do it now.

More news.

Good explanations.

Tags: patching, vulnerabilities

Posted on October 22, 2026 at 9:26 AM • 15 Comments

Comments

Clive Robinson • October 22, 2026 10:07 AM

Sent in parts due to auto-mod at 14:00UTC

Part 1,

@ Bruce, ALL,

A search Gave the following information,

“The critical PHP vulnerabilities were discovered by the cybersecurity firm Calif … and independently by researchers at Wiz”

If this is correct then the vulnerabilities were found by the use of AI systems.

Clive Robinson • October 22, 2026 10:09 AM

Part 2,

I could list another series of “AI Vulnerability Discoveries” but the list would be fairly lengthy…

Many have been dismissed as “slop” but sufficient have not to be of considerable concern.

These non slop AI findings have the feeling of being found at a rapid rate that is outstripping developers ability to fix them in a timely fashion.

I don’t know if anyone is keeping figures on this but it appears to be rattling lots of people including UK politicians (which is not good).

Thus I’m worried that ill advised precipitous political actions will be taken and we will suffer for a considerable period because of them.

Perry • October 22, 2026 10:28 AM

“Updating PHP is the only way to regain security.”

Updating PHP is the only way to mitigate these vulnerabilities, but doing so does NOT make PHP “secure.”

In fact, that train of thought borders on magical thinking. Because beyond on a shadow of doubt there exist other severe issues in PHP that have simply not been discovered.

Clive Robinson • October 22, 2026 10:36 AM

@ ALL,

The BBC is running a news “live update” on the PHP issue,

https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

It reports that 32 UK Gov sites are effected but as of yet, nobody has reported being attacked in the UK…

I would take that with a grain of salt about the size of Lott’s Wife …

There is however other news that is equally as worrying…

Indian Certificate Authority eMudhra has used rediculous signing key values for it’s top level certificates.

Thus something like 60million certificates are now garbage and it will be easily possible for anyone to fake certs that most browsers will accept untill the browsers and other Apps have been correctly updated (which they may never ve in the case of embedded systems such as consumer Routers and IoT devices…

You can read an Outraged at this article,

https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

There is however an ironically funny side to it… One of the PK cert values was “4” which many probably remember from a XKCD joke on a random number generator.

Have a look on the Current Friday squid for more on this,

https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html/#comment-459121

So two very serious security issues this week, and as the old saying has it,

“It’s not even over yet…”

wiredog • October 22, 2026 11:40 AM

It sounds like the cert issue was caused by training, or at least not intended for public use, certs being used. Sort of like if your corporate example.corporate.com accidentally got routed.

Also, xkcd is on top of it: https://m.xkcd.com/3314/

Rontea • October 22, 2026 12:56 PM

Re: rce through oom

Classic case of subtle memory handling biting back. This is a reminder of why error paths matter: PHP’s use of longjmp() to bail on OOM leaves partially initialized request memory hanging around, which can be touched during shutdown. Even unrelated allocations can trigger this. From there, RCE is just a matter of aligning the dominoes. Clean exits and consistent state handling are critical in any runtime, especially one this exposed.

lurker • October 22, 2026 1:38 PM

Many years ago I was given a PHP-MySQL server to feed and care for. The rate of security advisories and updates was a dismay to this newly fledged sysadmin with a lifetime experience in (non-computer) hardware engineering methods.

@Smooth Operator – yup, the gift that keeps on giving.

@Bruce – “Updating PHP is the only way to regain security. Do it now.”

No. As @Perry said: updating will not make PHP “secure.”
Getting rid of PHP is the only way to regain security. Do it now.

Clive Robinson • October 22, 2026 6:33 PM

@ Bruce, ALL,

Apparantly it’s not just PHP and eMudhra that is happening…

I mentioned above that AI was finding many software issues, and whilst many are seen as “AI Slop”, not all are…

Well it appears that in the “not all” camp there are several that would in other times be quite news worthy in of themselves if not being in effect “drowned out” by all the carfuffle and noise associated with the eMudhra and PHP issues.

Though some are saying the PHP issue could cause 3 out of 10 smaller servers to go down and stay down either for quite some time or permanently. That is quite a few are “to old to patch” or “upgrade” to later versions of PHP.

Some are said to be “old 32bit systems” of Win 7 vintage of more than a decade old. That have been sitting whirling away in dusty cupboards for years and can not be “upgraded”… so PHP versions 5.3 and 5.4 are creaking along… and have been seen in the wild as such.

Vesselin Bontchev • October 23, 2026 1:55 AM

Jokes aside (the vulnerability is indeed very serious), I have yet to see a reliably working exploit. None of those on GitHub are of this kind.

iAPX • October 23, 2026 6:38 AM

Different governments shut down many servers, NSA provided a strong recommandation to do so (its rare NSA is acting that way) until patched.

I stopped httpd on my instances, until I have upgraded them.
It’s easy for a private, not so for companies where they are unprepared for the nuclear option : shutdown.

Since my first hacked DNS Box on Linux, in 1994, when managing the infra I always ask for and obtain (it is not optional) to be able to shutdown accesses or any part of the infra. The nuclear option.

This option needs preparation, including procedures, processes, communication channels, identified owners and/or contact points.
Many small companies are not prepared for that.

Worse point in this situation : good hackers will not deface any website, they will extract informations silently, and they will probably keep a foot in your server wether you patch php or not.
Real impacts will be known on the mid-term …

freedom • October 23, 2026 12:33 PM

Getting rid of PHP is the only way to regain security.

And what is the replacement for PHP? Corporate malware like ASP? Or perhaps “client side” javascript malware?

iAPX • October 23, 2026 3:14 PM

@freedom

Probably Node.js, that happened to have security problems of the same level (CVSS 9+) disclosed the day after !!!

None platform is immune …
What’s matter is how quick the community acts when a security problem is found, and the way they communicate and fix it.

Clive Robinson • October 23, 2026 4:51 PM

@ iAPX, freedom, ALL,

With regards,

“What’s matter is how quick the community acts when a security problem is found, and the way they communicate and fix it.”

The problem is all to often the “to patch” time is way to long with 90days being the “responsible disclosure” time (or longer if the closed source corp can push it).

The thing is some of these vulnerabilities have been around for a decade or more and “kept quiet”[1] because they are useful to some. Just like knowing where to hit a locker with a Mitre lock for it to just pop-open. Similar with quite a few “gun safes”.

Thus rather than waiting in the “never never que” for a big corporate to do next to nothing towards issuing a patch…

I prefer the “Mitigation Path” that quite frequently stops the potential attack almost immediately. So when it can be stopped by a quick mitigation and getting that out can be faster and more useful than waiting in a vulnerable state for a never going to be done patch.

Sadly these days the only real fast mitigation is “power down, or disconnect from attackers”. Which is not a popular option in the “commercial Internet”.

In part because the consequences even of a full breach and sensitive records exfiltration is just about nil…

[1] Back in my younger days last century I was guilty of keeping “full break by keyboard at the login prompt” secret on a number of occasions. Such breaks were very useful especially in more secure environments. I’ve described a couple of them on this blog in the past.

ResearcherZero • October 24, 2026 4:43 AM

There is now a new CVE for PHP that affects non-default configurations. The full details and a patch for the new vulnerability have not been released. It is advised to apply mitigations to prevent the vulnerability from being exploited in case of working PoC.

The problem will be addressed in the next regular bugfix release. Read the mitigation advice carefully and follow the instructions at PHP to determine if the issue applies.

https://www.php.net/

ResearcherZero • October 24, 2026 6:27 AM

@Smooth Operator

You have used PHP plenty of times, including on October the 22nd, 2026 at 10:46 AM. The imaginary times do not count, but as much of the internet runs on it, you use it when you are not even aware. Your personal information is contained within systems running PHP.

Communications and information systems contain vulnerabilities, just as buildings, homes and other dwellings contain points of access. Objects that contain or house things are designed to be accessible, and security is largely added after the construction phase is finished. Most objects were never designed with security in mind. Utility was the purpose.

It takes little mobility or intelligence to enter and object. The simplest lifeforms are capable of entering facilities that were built with at least some security in mind.

The Cladosporium group of fungi can be an irritant (affecting the lungs), yet varieties of this fungi can survive in ecological niches that are formidable, like nuclear reactors.
Another species of fungi, Cryptococcus neoformans can nearly quadruple its growth rate under intense radiation. These fungi can rapidly replace damaged proteins or repair DNA.

Some of these fungi grow towards sources of beta and gamma ionizing radiation, yet the biological process is still being studied. When the fungi are exposed to radiation they rapidly alter the chemical properties within the fungus, speeding up their melanin-mediated electron transfer rate, enabling them to increase their growth rate in less than an hour of exposure. Either due to improved cell use of nutrients, or direct cellular absorption of ionizing radiation. Further study is required to understand the exact mechanisms at play.

Radiotrophic fungus

One theory is that such fungi and yeasts can absorb ionizing radiation and convert it to energy in process named radiosynthesis. Many of these fungi promote growth in other plants. It is yet to be determined if photosynthesis or chemosynthesis plays any role in radiosynthesis. Melanin can interact with high-energy electromagnetic radiation and transduce it to chemical and electrical energy, but radiosynthesis takes place through very different mechanisms in fungi, than the mechanisms involved in photosynthesis in plants.

It is believed that radiation assists chemical conversion in fungi, and this helps improve the function of cellular activity. However, it is very difficult to study the processes. A small amount of radiation absorption has been demonstrated in experimental demonstrations.

Getting “in” is very easy. Determining what is going on, how systems function, and then utilizing that knowledge constructively, can be a far more difficult exercise. Any fool can hit something with a hammer, but to forge and shape pig iron into a tool requires aptitude.

https://journals.asm.org/doi/10.1128/microbiolspec.funk-0037-2016

Schneier on Security

New Serious PHP Vulnerabilities Released and Patched

Comments

Leave a comment Cancel reply