The PHP project shipped emergency updates on October 21, 2026, closing two critical security holes in the language's core engine. Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix vulnerabilities that each scored 9.2 out of a possible 10 on the CVSS v4.0 severity scale, meaning an attacker needs no credentials to potentially take over a server. The PHP security team was blunt about the stakes, stating there are "no complete mitigations" and that updating is "the only safe choice."
Where the bugs live and why that matters
Both flaws sit in the request lifecycle of the PHP runtime itself, not in a Composer package or a piece of application code. That distinction matters because it means the bugs can be triggered before any developer-written logic even executes, and standard dependency scanners that check manifest files like composer.json won't catch them.
The first, CVE-2026-109618, stems from how PHP handles running out of memory mid-request: an attacker can force a worker process to hit its memory limit, causing cleanup routines to mistakenly treat partially initialized data as valid. The second, CVE-2026-109619, involves stale internal state surviving after memory is freed, so a later request handled by the same long-lived worker can reuse corrupted data before proper initialization occurs. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed setups are all exposed, with Apache's mod_php configuration reportedly vulnerable to a single unauthenticated request.
A follow-up warning on session settings
Two days later, on October 23, PHP issued an informational advisory for a related, reserved CVE describing a narrow bypass of one of the original fixes. It only applies to applications that set session.serialize_handler to php_binary or php_serialize and then switch it to php at runtime using ini_set() before calling session_start(), while session upload progress tracking is enabled. Because this scenario is uncommon, PHP is not rushing a separate patch; the existing recommended setting, session.upload_progress.enabled=0, already blocks it.
What administrators should do
- Update immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, verifying the actual running version on each host rather than trusting scan results alone.
- Pull patched packages from Linux distributions or LTS vendors, which received fixes in advance and may keep familiar version numbers while carrying the patch.
- On PHP 8.1 or older, which no longer receives official updates, apply a distribution backport or use the minimal source backports PHP published for 7.4, 8.0, and 8.1 as a last resort.
- If immediate patching isn't possible, apply partial mitigations such as memory_limit=-1, a low post_max_size, and session.upload_progress.enabled=0 followed by restarting all workers.
PHP 8.2 is also scheduled to reach end of life on December 31, 2026, giving administrators still on that branch an added reason to plan their next upgrade alongside this fix.