Php 8 5 12 - GoKawiil

PHP Foundation patches two critical remote code execution flaws in PHP 8.2–8.5

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released to fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that could let unauthenticated attackers execute code on servers running PHP. One flaw involves memory corruption triggered when a request hits the memory_limit at a precise moment, while the other involves stale internal state left behind after a fatal error, both of which were shown to enable full remote code execution under common configurations like Apache with mod_php and PHP-FPM.

thephp.foundation · 2026-10-21

PHP patches two critical RCE flaws in 8.5.12, 8.4.27, 8.3.36 and 8.2.35

The PHP project has released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let unauthenticated attackers achieve remote code execution. The flaws stem from out-of-memory handling and stale global state issues affecting PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed deployments. PHP versions 8.1 and earlier no longer receive official fixes, so users on those versions must seek vendor backports or upgrade.

php.net · 2026-10-21