PHP ships emergency patches for two critical unauthenticated RCE bugs, update to 8.5.12+
jedisct1 · x · 2026-10-21
- PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing two critical vulnerabilities allowing unauthenticated remote code execution. All PHP installations serving web requests are at risk (PHP-FPM, modphp, php-cgi, FrankenPHP, LiteSpeed), with modphp highest risk—a working exploit can trigger before any app code runs.
- CVE-2026-109618: OOM handling interrupts partial request initialization, letting cleanup treat invalid data as valid. CVE-2026-109619: stale global state survives memory free and is reused by a later request on the same worker.
- Users should update immediately; PHP 8.1 and older no longer receive official updates, and remirepo users are urged to switch to distro packages.
More from Safety
- Meta pauses Muse chat sharing after firm finds 6,800 publicly accessible conversations — mark_k · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22
- Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web — ralucaadapopa · 2026-10-22