GoKawiilPHP patches two critical RCE flaws in 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit can reportedly trigger before any application code runs, essentially every PHP-driven website is exposed until patched, making this a high-urgency issue for hosting providers and site operators alike. The advisory's emphasis on mod_php as highest risk suggests attackers could target widely deployed legacy configurations first. Users of the volunteer-run rpms.remirepo.net are also advised to move to official distribution packages, hinting at possible delays in unofficial repositories applying the fix.
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two critical unauthenticated RCE vulnerabilities.
- mod_php setups face the highest demonstrated risk, with exploits possible before app code executes.
- PHP 8.1 and older get no official patches; users must rely on vendor backports or upgrade.
Source: php.net, 2026-10-21
Published there as: “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.