New Serious PHP Vulnerabilities Released and Patched

PHP maintainers patched four release lines: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities. The danger matters because attackers may be able to run code without first logging in.

The practical example is any PHP installation serving web requests. A vulnerable server could process a crafted unauthenticated request and reach one of the flaws. The article identifies two mechanisms: corrupted cleanup data after an out-of-memory event, and stale request state reused by a later request.

All PHP users are strongly encouraged to update immediately. The article calls updating PHP the only way to regain security. That advice applies across PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Delaying the update leaves exposed web-facing installations at risk.

The maintainers fixed two critical vulnerabilities in the listed PHP releases. Both are described as capable of allowing unauthenticated remote code execution, or RCE. This is especially serious because the attacker does not need to authenticate before attempting the attack.

The flaws use different mechanisms. CVE-2026-109618 involves out-of-memory handling that can leave internal request data partly initialized, after which cleanup may treat invalid data as valid. CVE-2026-109619 involves request-owned internal state surviving after its backing memory has been freed, allowing a later request to use stale state.

The current risk includes PHP installations serving web requests. The article considers mod_php the highest-risk setup because it has a demonstrated exploit that can trigger before application code runs. Updating to a patched PHP release is the only stated way to regain security.

Unauthenticated remote code execution means an attacker can cause a remote PHP server to execute attacker-chosen code without first proving an identity or signing in. “Remote” means the attempt comes through a network request. “Execution” means the server processes code rather than merely returning data.

The article describes a demonstrated mod_php exploit where an unauthenticated request can trigger the attack before any application code runs. That makes the vulnerability especially severe. The request does not depend on a normal login flow or on a particular application feature executing first.

The immediate reality is that all PHP installations serving web requests are at risk. The article names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Because the issue is in PHP itself, the stated remedy is to update to a patched release immediately.

The risk covers all PHP installations serving web requests. The article specifically names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. These setups can expose PHP to requests that reach the vulnerable request-handling paths.

The risk is considered highest for Apache using mod_php because the article reports a demonstrated exploit. An unauthenticated request can trigger the attack before any application code runs. That means the vulnerable behavior may be reached without relying on a particular application route or on application logic completing first.

This distinction does not make the other installations safe. The article describes both vulnerabilities as affecting PHP users broadly and urges all users to update immediately. It identifies updating PHP as the only way to regain security, so changing application code alone is not presented as a sufficient fix.

An out-of-memory condition means PHP cannot obtain enough memory for its current work. In the vulnerability described as CVE-2026-109618, that failure can interrupt PHP while internal request data is only partly initialized. The request therefore contains incomplete internal information.

The key mechanism appears during request cleanup. Cleanup expects request data to be valid and complete, but the interrupted operation left invalid or partial data behind. The cleanup process may treat that data as legitimate instead of recognizing that initialization failed. That mismatch is the central error described in the article.

The consequence is serious because the flaw is classified as remote code execution. A crafted unauthenticated request may reach the problematic path in a vulnerable web-serving installation. The article does not describe every exploitation step, but it clearly states that patched PHP releases fix the issue and urges immediate updating.

A PHP worker handles requests over time, so internal request-owned state must be discarded and rebuilt for each request. The second vulnerability occurs when that state survives after the memory supporting it has already been freed. The worker then carries an invalid leftover reference between requests.

The article describes a later request handled by the same worker using the stale state before normal initialization resets it. In simple terms, the worker believes old request information is still available, even though the memory behind it no longer belongs to that request. That mismatch can create unsafe behavior.

This is CVE-2026-109619, described as RCE via stale global state. The risk depends on a later request reaching the same worker, but the article still treats it as critical and affecting PHP web installations. Updating PHP is the stated way to remove the vulnerable behavior and regain security.

The article does not define PHP. In general, PHP is a server-side programming language and runtime used to process web requests and build web applications. It runs on the server rather than in the visitor’s browser, then produces a response for the web server to send back.

A typical flow begins when a browser sends a request to a web server. The server connects that request to PHP through a setup such as PHP-FPM, Apache with mod_php, or php-cgi. PHP initializes request data, runs the application’s PHP code, and creates output. The server then returns that output to the requester.

The article’s vulnerabilities affect PHP’s internal request handling, not only application logic. One flaw involves partial initialization after an out-of-memory event. Another involves stale state reused by a later request. Because those paths can be reached while serving requests, the article urges immediate PHP updates.