GoKawiilPHP Foundation patches two critical remote code execution flaws in PHP 8.2–8.5
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.
GoKawiil's interpretation of the reporting above, not reported fact.
The severity and reach of these bugs—exploitable without authentication and before application code even runs—underscore how foundational PHP remains to much of the web, making prompt patching urgent for site operators. The PHP Foundation's decision to detail how these flaws were discovered and fixed suggests an effort to highlight its ongoing security work and press organizations that rely on PHP to contribute resources toward sustaining it.
- PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities.
- Both flaws could allow unauthenticated remote code execution under default or common server configurations.
- The PHP Foundation is using the disclosure to call for more support from organizations that depend on PHP.
Source: thephp.foundation, 2026-10-21
Published there as: “PHP Foundation's Overview of CVE-2026-109618 and CVE-2026-109619”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.