Patching PHP’s Two Critical RCEs

On 21 October the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on CVSS v4, and neither needs authentication. Both advisories say updating is the only complete fix.

Fixed Versions

Branch Fixed in
8.5 8.5.12
8.4 8.4.27
8.3 8.3.36
8.2 8.2.35
8.1 and older No upstream release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1; Debian and Ubuntu users can get fixed builds from packages.sury.org; otherwise check your LTS vendor.

Linux distributions received the patches in advance, so most systems get the fix as a normal package update.

The Two Bugs

CVE-2026-109618 is in out-of-memory handling. PHP aborts on an out-of-memory error with longjmp(). If that happens while it’s still parsing the request body, request data is left half-initialized, and request shutdown later processes it as valid. Crafted multipart requests can trigger this while staying inside PHP’s input limits. The fix removes longjmp() from out-of-memory handling.

CVE-2026-109619 is a use-after-free. A request that’s interrupted by a fatal error, a timeout or running out of memory can leave freed state behind on the worker, and a later request on the same worker can read it before initialization resets it. Confirmed paths include session upload progress, which is on by default and doesn’t need session_start(), and PHP 8.5’s fatal_error_backtraces. The impact includes memory disclosure as well as code execution.

Exposure by Server API

SAPI CVE-2026-109618 CVE-2026-109619
Apache mod_php Code execution validated with default limits, before application code runs Code execution confirmed
PHP-FPM Exploitable by source analysis, not fully demonstrated Code execution validated through session upload progress; depends on the application
php-cgi, FrankenPHP, LiteSpeed Listed as at risk by php.net

Checking What You Run

The CLI and the web server often run different PHP packages, so check the one serving requests:

php -v                      # CLI only
php-fpm -v                  # often versioned: php-fpm8.3 -v
apachectl -M | grep -i php  # is mod_php loaded?
apt policy php8.3-fpm       # Debian/Ubuntu: installed version and its repo

On Debian and Ubuntu, fixed builds reached packages.sury.org before the ppa:ondrej/php Launchpad PPA, so confirm the installed version if you use the PPA. Ondřej Surý is tracking the rollout, including the end-of-life branches, in this issue.

After updating, restart PHP-FPM or Apache so no worker is still running the old build. The full details, including interim settings for systems that can’t update immediately, are in the php.net advisory.