PHP released fixes on October 21, 2026, for two critical vulnerabilities in its core runtime: CVE-2026-109618 and CVE-2026-109619. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says upgrading to a fixed release is the only complete remediation.
What the two PHP flaws do
CVE-2026-109618 involves out-of-memory corruption: PHP can be interrupted while request data is only partly initialized, leaving cleanup code to handle that data as if it were complete. CVE-2026-109619 involves stale internal state that can be reused by a later request after its backing memory has been freed.
Depending on the flaw and deployment conditions, the impact can include unauthenticated remote code execution or disclosure of process memory. Google Cloud assigned each vulnerability a CVSS v4.0 base score of 9.2.
PHP lists web-serving installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk, and identifies mod_php as the highest-risk configuration. These are vulnerabilities in PHP’s core runtime, rather than a flaw confined to a particular application.
Fixed PHP versions and older branches
| PHP branch | Fixed release |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
The PHP security notice says PHP 8.1 and older no longer receive regular upstream security updates. The project supplied minimal source backports for 7.4, 8.0 and 8.1; distributions and long-term-support vendors may also provide their own patched packages. PHP says web application firewall rules and configuration measures can reduce exposure, but do not replace installing a fix.
On October 23, Cloudflare reported a separate issue, CVE-2026-115560, which the October 21 releases do not fix. PHP describes an uncommon configuration involving a runtime change to session.serialize_handler before session_start() while session upload progress is enabled.
Researchers, AI assistance and the response
OpenAI’s October 21 account attributed a critical finding to Calif, using GPT-5.6 Sol, as part of Patch the Planet. Calif researcher Ryan Austin described using a large language model in researcher-directed work, alongside his PHP experience and knowledge of earlier vulnerabilities.
The timelines also include separate contributions. Calif says it found multiple remote-code-execution paths on August 1, 2026, and reported its first bug to PHP on August 11. Wiz says it independently discovered a vulnerability on August 19 and reported the issues to PHP on August 24. The PHP Foundation says OpenAI separately reported the same root cause and further attack paths, including on September 18. PHP maintainers led the fixes and the October 21 release.
Patch the Planet was already an OpenAI initiative before the PHP disclosure; OpenAI had announced it on June 22, 2026. On October 21, OpenAI also proposed a five-stage framework for future coordinated vulnerability disclosures.
Amazon reported that an attempted exploitation reached its MadPot honeypot on October 17, before public disclosure. The report concerned activity against that honeypot.
