[Diary Point=Reporter Eom Ju-yong] Two critical vulnerabilities in PHP that could allow an unauthenticated attacker to execute code remotely have been identified, and security updates have been released to address them. The PHP development team is urging immediate updates for every PHP installation that handles web requests.
In a security advisory issued on the 21st, the PHP team listed PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as the versions that fix CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received a CVSS 4.0 score of 9.2 and can lead to remote code execution without any authentication.
The first flaw involves improper handling of uninitialized internal request data when the system is under low-memory conditions. The second occurs when internal state tied to a request persists in memory after being freed, allowing it to be reused in a subsequent request.
Potentially affected environments span nearly every PHP setup that processes web requests, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team noted that the risk is especially high for mod_php environments, where an attack can be triggered by an unauthenticated request before any application code even runs.
Administrators should update to the fixed version or later for whichever PHP branch they are running. Those relying on packages from Linux distributions or long-term-support OS vendors should also verify whether the relevant security patches have been applied by those vendors.
PHP 8.1 and earlier versions no longer receive updates from the PHP project. While some distributions and LTS vendors may provide separate fixes, the PHP team advises checking with those vendors or upgrading to a supported version. Security support for PHP 8.2 is scheduled to end on December 31, 2026.
Some configuration-based mitigations were also published for those who cannot update immediately, but the PHP team does not consider them a complete fix. The core recommendation in the advisory remains updating to the patched versions — temporary workarounds only reduce exposure to specific attack paths and do not make an installation fully secure.