PHP ships emergency patches for two critical unauthenticated RCE flaws, CVSS 9.2

cyb3rops · x · 2026-10-21

PHP.net has released a security advisory fixing two critical vulnerabilities that allow unauthenticated remote code execution, shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All PHP installations serving web requests are urged to update immediately.

CVE-2026-109618 (RCE via OOM corruption): out-of-memory handling can interrupt PHP while request data is only partially initialized; cleanup may then treat invalid data as valid. Risk is highest for Apache modphp, where a demonstrated exploit triggers before any application code runs. CVSS 9.2.
CVE-2026-109619 (RCE via stale global state): request-owned internal state survives after its memory is freed, and a later request on the same worker may consume it before initialization.

Affected SAPIs include PHP-FPM, modphp, php-cgi, FrankenPHP and LiteSpeed. PHP 8.1 and older no longer receive official updates. Interim mitigations: set an unoverridable memorylimit=-1, lower postmaxsize (8M if no uploads needed), use container/cgroup limits that kill only affected workers, set session.uploadprogress.enabled=0 and restart workers, and on PHP 8.5 set fatalerrorbacktraces=0. The volunteer rpms.remirepo.net repo has no updates today; users should switch to distro packages or build from source.

Original post →

PHP ships emergency patches for two critical unauthenticated RCE flaws, CVSS 9.2

More from coding & agent