PHP releases fixes for two critical vulnerabilities

PHP published fixes on October 21, 2026, for CVE-2026-109618 and CVE-2026-109619: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security release addresses two flaws that PHP rates CVSS v4.0 9.2 each. PHP says temporary settings can reduce exposure to specific attack paths, but updating is the complete fix.

PHP’s fixed versions, branch by branch

Install the release that matches the PHP branch you run:

For PHP managed by a hosting provider or Linux distribution, use that vendor’s package containing the fix. Vendors may package updates on their own schedules, so the upstream release numbers are not a substitute for the version supplied for your system.

What the two vulnerabilities do

PHP describes CVE-2026-109618 as a flaw in out-of-memory handling. If a request is interrupted while internal data is only partly initialized, later cleanup can treat invalid data as valid. That can create a path to remote code execution, meaning an attacker could make the server run code through a web request.

CVE-2026-109619 involves stale request-owned state. Data from one request can outlive the memory backing it, then be used by a later request handled by the same worker. PHP says both flaws put web-serving installations at risk without requiring authentication.

Web-serving PHP configurations PHP identifies

PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the web-serving configurations at risk. It identifies mod_php as the highest-risk mode because an unauthenticated request can reach the vulnerable path before application code runs.

These are PHP runtime vulnerabilities. Updating a CMS or framework alone does not patch the PHP runtime; the fix needs to reach the PHP build serving requests.

What interim settings can and cannot do

PHP’s temporary measures target particular paths. For CVE-2026-109619, disabling session.upload_progress.enabled and restarting every worker blocks confirmed session-related paths, but not other variants. On PHP 8.5, setting fatal_error_backtraces=0 blocks the confirmed fatal-backtrace path only.

For CVE-2026-109618, PHP recommends memory_limit=-1 configured so applications cannot override it, a low post_max_size and appropriate resource boundaries. PHP specifies 8M where uploads are not needed and 32M where they are. It also warns that underlying allocation failures can still reach the vulnerable path.

Those controls reduce exposure; PHP says they do not make an installation safe. Updating the PHP runtime is the complete remediation.

PHP 8.1 and older

PHP says PHP 8.1 and earlier no longer receive PHP-project updates. It published minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source or without access to a long-term-support vendor. A source backport is not the same as a fix installed through a distribution or hosting package, so operators on these branches need a vendor-provided package or an upgrade to a supported branch.