GoKawiilPHP releases 8.5.12 fixing two critical remote code execution flaws
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit can reportedly fire before application code executes, standard web app security measures may offer little protection, making prompt patching the primary defense. Server admins running older PHP branches like 8.1 should note those versions no longer receive security updates, which could leave a large number of legacy deployments permanently exposed unless they migrate. Linux distributions and LTS vendors reportedly got advance notice, suggesting patched packages may already be available through standard channels.
- PHP 8.5.12 fixes two critical unauthenticated RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
- mod_php is considered highest risk, with a demonstrated exploit path requiring no authentication
- PHP 8.1 and earlier no longer get security patches, leaving unsupported installs vulnerable
Source: techspot.com, 2026-10-21
Published there as: “PSA: PHP patches two critical flaws, server admins urged to update”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.