PHP Critical RCE Patch: CVE-2026-109618 and CVE-2026-109619 (Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35)

What happened

On October 21, 2026, the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution vulnerabilities. Both are rated CVSS v4.0 9.2 (Critical) in the project's advisories, with the vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Neither needs authentication. The vector carries AC:H and AT:P. Willison notes that an early leak cited a CVSS of 10.0, which was wrong.

• CVE-2026-109618, RCE via OOM corruption: GHSA-w8hw-w9fx-j79w. CVSS v4.0 9.2 Critical.
• CVE-2026-109619, RCE via stale global state: GHSA-6wmf-4rv5-p3rp. CVSS v4.0 9.2 Critical.
• Affected (both): versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• Fixed (both): 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Both advisories list the same five weakness types: CWE-416 (use after free), CWE-755 (improper handling of exceptional conditions), CWE-824 (access of uninitialized pointer), CWE-1325 (improperly controlled sequential memory allocation) and CWE-1419 (incorrect initialization of resource). After the CVE IDs leaked on October 20, the project issued a pre-announcement and moved the release from October 22 to October 21, according to Simon Willison.

Who is at risk

The PHP project says the risk is highest for mod_php, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." The advisory for CVE-2026-109618 says unauthenticated remote code execution was validated against mod_php with default PHP input and memory limits. All web-serving PHP is in scope, including FPM, php-cgi, FrankenPHP and LiteSpeed. The advisory says no complete exploit was demonstrated against FPM for CVE-2026-109618, while the CVE-2026-109619 upload-progress chain was validated against both mod_php and FPM.

Check three things on every host:

1. Run php -v for the CLI and confirm the web SAPI version too (mod_php, FPM and CLI can differ).
2. Look for containers and base images pinned to an older 8.x tag.
3. List any PHP 8.1 or older systems. The project no longer ships updates for them.

Is it being exploited?

Proof-of-concept exploits are circulating. No source we read confirms attacks in the wild. Here is what each one says.

• PHP project: no statement that either flaw is exploited in the wild. It did say an exploit was demonstrated against mod_php.
• CISA KEV: neither CVE is in the catalog version released October 23, 2026.
• Simon Willison: writes that "there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process." He quotes the PHP Foundation: the CVE IDs began circulating on October 20 without technical details, then a security firm mistakenly published a video that "showed their proof of concept working against a number of targets." Copies of the deleted video spread on social media, and the video "contributed to accelerated development of various PoCs." He does not report confirmed attacks in the wild.

Treat it as patch-now. Public PoC circulation plus a vendor-validated exploit against default mod_php settings is enough reason.

What to do

Update. The PHP project says there are no complete mitigations and updating is the only safe choice. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.2 reaches end of life on December 31, 2026, so plan the move to 8.3 or later.

On PHP 8.1 or older, the project published minimal source backports on GitHub branches named PHP-7.4-CVE-2026-109618-109619, PHP-8.0-CVE-2026-109618-109619 and PHP-8.1-CVE-2026-109618-109619. Some distributions and LTS vendors ship their own backports, so ask yours first.

If you cannot update today, the vendor lists partial measures. It says these do not make an installation safe.

• CVE-2026-109618: set memory_limit=-1 (preferably through php_admin_value), set post_max_size to 8M if you take no uploads or 32M if you do, keep upload_max_filesize below it, and enforce a container or cgroup memory limit. Do not use RLIMIT_AS or RLIMIT_DATA. An underlying allocation failure path remains even with memory_limit=-1.
• CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the FPM pool config (not via ini_set() or .user.ini) and restart workers. On PHP 8.5, set fatal_error_backtraces=0.

Related: informational advisory for CVE-2026-115560

On October 23, the project published an informational advisory for CVE-2026-115560 (session upload progress), which it describes as an unlikely RCE vector. It suggests session.upload_progress.enabled=0 until the next regular bugfix release, and the full advisory comes with that release. That is the same setting listed above for CVE-2026-109619.

Sources

• PHP.net news and release announcements
• GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp
• Simon Willison, Oct 21, 2026
• CISA Known Exploited Vulnerabilities catalog

CVSS figures here come from the PHP project's GitHub advisories.

php.net's ChangeLog lists 8.5.12 and 8.4.27 under October 22, while the announcements and advisories say October 21.