PHP Foundation patches four branches to fix critical RCE flaws in Apache mod_php and PHP-FPM

The PHP Foundation released security updates for four major version branches on October 21, 2026, to address two critical remote code execution vulnerabilities. Organizations running PHP 8.2 through 8.5 must update immediately to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, according to the foundation's announcement. The flaws affect memory management and error handling components that process nearly every request.

What vulnerabilities are addressed in these releases?

The updates fix CVE-2026-109618 and CVE-2026-109619, both rated as critical severity. CVE-2026-109618 involves out-of-memory corruption, where reaching the memory limit at a specific moment leaves partially initialized data that PHP later treats as valid. This can corrupt memory and allow unauthenticated code execution on Apache with mod_php before application code runs, or via PHP-FPM through application-level paths.

CVE-2026-109619 stems from stale state issues where a fatal error leaves internal state pointing to freed memory from a previous request. A subsequent request handled by the same worker can access this memory, leading to use-after-free conditions and worker crashes. The reporter demonstrated remote code execution against a real-world application using Apache with mod_php.

How were these security flaws discovered?

These vulnerabilities were identified following a 2024 external security audit conducted by Quarkslab, funded by the Sovereign Tech Agency through OSTIF. While a PHP core developer contracted by the PHP Foundation was fixing an issue reported by Quarkslab, they found initial signs of the out-of-memory problem behind CVE-2026-109618. This discovery highlights the value of external audits in uncovering complex memory management issues within the core engine.

Why are these fixes particularly difficult to implement?

Both vulnerabilities reside in central parts of PHP that handle memory management and error processing, affecting nearly every request. The foundation noted that fixing these issues without breaking compatibility, reducing performance, or forcing changes on third-party extensions was challenging. The deep integration of these components into the engine makes any modification risky for the broader ecosystem of PHP applications and modules.

What is the current status of exploitation?

Remote code execution was demonstrated with default settings for CVE-2026-109618 on Apache with mod_php, and confirmed for PHP-FPM via application-level code paths. For CVE-2026-109619, remote code execution was demonstrated against a real-world application. The foundation stated that organizations running PHP must update now, emphasizing the imperative nature of the patch.

Questions to ask your suppliers

Operations teams should verify if any third-party PHP extensions or modules are affected by these core memory changes. Ask vendors whether their products have been tested against the newly released PHP versions to ensure compatibility. Confirm that suppliers have not introduced custom memory management hooks that might bypass standard PHP error handling. Ensure development teams are aware of the potential for subtle behavioral changes in error reporting and memory allocation post-update.

What to do and how to stay safe: PHP

• Update all PHP servers to the latest patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) as soon as possible.
• Monitor server logs for unusual memory usage patterns or unexpected worker crashes that might indicate exploitation attempts.
• Review application code for any custom memory management or error handling that might interact poorly with the patched core.
• Verify that third-party PHP extensions are compatible with the updated PHP versions before deploying to production.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

PHP versions 8.2, 8.3, 8.4, and 8.5 are affected, with patches released as 8.2.35, 8.3.36, 8.4.27, and 8.5.12 respectively.

Can unauthenticated attackers exploit these vulnerabilities?

Yes, unauthenticated attackers can trigger remote code execution on Apache with mod_php and PHP-FPM under specific conditions, according to the PHP Foundation.

Were these vulnerabilities found through an external audit?

Yes, the issues were discovered following a 2024 external security audit by Quarkslab, funded by the Sovereign Tech Agency.