PHP fixes two critical flaws that let attackers run code on web servers without logging in

The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, to fix two critical vulnerabilities. Both can allow remote code execution, meaning an attacker runs their own code on the server, and neither requires a login. The project asks every PHP user to update immediately, and the US cybersecurity agency CISA has issued the same call.

What the two flaws do

The first, CVE-2026-109618, sits in how PHP handles running out of memory. If a request hits the memory_limit at the wrong moment, PHP can leave internal request data half initialized and later treat it as valid. On Apache with mod_php, the PHP Foundation says an unauthenticated request triggers this before any application code runs, and full code execution was shown with default settings. On PHP-FPM, code execution was confirmed through paths in application code.

The second, CVE-2026-109619, is a use-after-free: internal state from one request survives after its memory is released, and a later request in the same worker uses it. The researcher who reported it demonstrated code execution against a real application running on mod_php.

The php.net advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as affected, and rates mod_php as the highest risk.

Who has to update

Linux distributions and long-term support vendors received the patches in advance, so updated packages come from them. PHP 8.1 and older get no releases from the project. Because the flaws are this severe, the security team published minimal source patches for 7.4, 8.0 and 8.1 for anyone who builds PHP from source.

CISA goes further for systems that cannot be updated. Its alert says organizations still on PHP 8.1 or earlier, or unable to patch, should take those systems offline until they are fixed. As of its alert, CISA had not observed successful exploitation.

If the update has to wait

The project lists settings that narrow specific attack paths, and states plainly that none of them makes an installation safe:

• Set memory_limit=-1 in a place applications cannot override, such as php_admin_value in the FPM pool or Apache configuration.
• Lower post_max_size to 8M for applications without uploads, or 32M where uploads are needed.
• Set session.upload_progress.enabled=0 in php.ini or the pool configuration, then restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.

Attacks started before the fix

Amazon's threat intelligence team says one of its MadPot honeypots recorded an exploitation attempt on October 17, 2026, four days before public disclosure. The attempt came from an anonymization network, and Amazon says it is unclear how the attacker obtained the details. Proof-of-concept exploits appeared on the day of the release, and Amazon now reports broad exploitation attempts.

Amazon recommends starting any investigation from October 17 rather than from the disclosure date. It also suggests looking for POST requests that carry the PHP_SESSION_UPLOAD_PROGRESS field.

On October 23, 2026, the project added an informational advisory, CVE-2026-115560. It affects only an unusual configuration, and the project suggests keeping session.upload_progress.enabled=0 until the next regular release.

Why the fix took two years

The first signs of the memory problem were found in 2024, during an external audit carried out by Quarkslab. The PHP Foundation writes that no concrete attack path was known then, every candidate fix had drawbacks, and work stalled for months. The security firm Calif began a new audit on July 30, 2026, and reported unconditional code execution on August 11, 2026. OpenAI and Wiz reported further attack paths in August and September.