PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities
cyber_forecast · x · 2026-10-21
PHP has released an urgent security advisory for two critical vulnerabilities allowing unauthenticated remote code execution, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- CVE-2026-109618: out-of-memory handling can interrupt PHP mid-request, leaving internal request data partially initialized that cleanup code then treats as valid.
- CVE-2026-109619: request-owned internal state can survive after its backing memory is freed, letting a later request on the same worker use stale state.
All PHP installations serving web requests are at risk — PHP-FPM, modphp, php-cgi, FrankenPHP and LiteSpeed — with modphp considered highest risk: a demonstrated exploit triggers the attack before any application code runs. Linux distros and LTS vendors received patches in advance; PHP 8.1 and older are no longer supported, and remirepo users are urged to switch to distro packages or build from source.
More from coding & agent
- OpenAI upgrades all 10,000 Codex for OSS grants to Pro 200 tier — jxnlco · 2026-10-22
- Sodabase launches to auto-detect and fix broken Supabase tables your agents silently broke — santiviquez · 2026-10-22
- MCP Inspector ships one package with Web, CLI and TUI clients for debugging MCP servers — craigsdennis · 2026-10-22
- Dev builds a human-and-AI Cookie Clicker with ChatGPT Sites, a database and an MCP server — craigsdennis · 2026-10-22
- OPAL: an agent rewrites optimizer source code during training, beating static recipes — vincesitzmann · 2026-10-22
- CUDA's moat quietly eroding as Codex can rewrite kernels for AMD, investor notes — paigeinsf · 2026-10-22