PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.
thephp.foundation
· 2026-10-21
The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.
php.net
· 2026-10-21
The PHP project has issued version 8.5.12 to patch two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let an attacker achieve unauthenticated remote code execution. One flaw stems from out-of-memory handling corrupting partially initialized request data, while the other involves stale internal state persisting across requests on the same worker. The advisory says all web-facing PHP setups are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php deemed highest risk since a working exploit can trigger before any application code runs.
techspot.com
· 2026-10-21
The PHP security team issued emergency updates fixing two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, found by researchers from Calif, Wiz, and OpenAI. Both bugs stem from memory corruption when requests end abnormally and affect nearly all PHP deployments that handle web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with limited source backports offered for older 7.4, 8.0, and 8.1 branches.
bleepingcomputer.com
· 2026-10-21
A developer built Qbix, a PHP webserver that forks thousands of lightweight worker processes from a single parent process using pcntl_fork(), relying on the Linux kernel's copy-on-write memory sharing. Unlike FrankenPHP, RoadRunner or PHP-FPM, which are limited by worker count due to memory duplication, Qbix lets each worker share the framework's loaded classes and only pay memory costs for pages it actually modifies during a request.
qbixserver.com
· 2026-09-18
GoKawiil