PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two leaked RCE flaws

The PHP project published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:34 UTC on October 21, 2026, slightly ahead of its announced 14:00 UTC slot. The releases fix CVE-2026-109618 and CVE-2026-109619, two bugs the PHP security team rates 9.2 under CVSS v4.0 and says can allow unauthenticated remote code execution. Its advisory lists every installation that serves web requests as at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The team considers mod_php the highest risk, with a demonstrated exploit that fires before any application code runs. WordPress, Drupal, Magento, WooCommerce and Laravel sites are all exposed through the PHP build underneath them.

How the two bugs work

CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is an out-of-memory bug. PHP aborts a request with longjmp() when an allocation fails, and if that happens while internal request data is only partly initialized, request cleanup later treats the invalid data as valid. The advisory describes several ways to force the out-of-memory condition through the multipart parser: a request with no usable Content-Length can slip past the post_max_size check, a multipart part can carry an unlimited number of headers, and empty file fields create metadata arrays without counting toward max_file_uploads.

CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is a use-after-free across requests. A fatal error or a late warning can leave a worker's global state pointing at memory that belonged to the previous request. When the same worker takes the next request, input, session or error handling code can read that stale pointer before normal initialization replaces it. With a prepared heap layout, the advisory says, this leads to code execution.

Leak and attack reports before the release

The fixes were under embargo for disclosure on October 22, according to watchTowr. On October 20 the CVE numbers appeared on Hacker News and social media, along with a screenshot of an exploit tool called "PHP2Shell" whose banner claimed it worked on every release from PHP 5.4.0 on. PHP posted an advance notice that afternoon, and CERT-EU issued advisory 2026-018. watchTowr said it reproduced CVE-2026-109618 in its lab. On the morning of October 21, Cloudflare CTO Dane Knecht said the company was "seeing early attacks emerging" and pushed WAF rules to every plan, including free accounts. Neither CVE was in CISA's Known Exploited Vulnerabilities catalog when we published.

Fixed versions and older branches

• PHP 8.5: 8.5.12
• PHP 8.4: 8.4.27
• PHP 8.3: 8.3.36
• PHP 8.2: 8.2.35

PHP says Linux distributions and LTS vendors received the patches in advance, so updated distribution packages should follow quickly. PHP 8.1 and older get no official release. The security team did publish minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source and have no LTS vendor. PHP 8.2 reaches end of life on December 31, 2026.

The advisory also says the volunteer-run Remi repository, common on AlmaLinux and Rocky servers, will not have updates on October 21. PHP recommends that Remi users switch to distribution packages or build from source so they can patch today.

Partial mitigations listed in the advisory

PHP states that only an update is a complete fix. The measures below reduce exposure to the known attack paths without making a server safe. WordPress and Magento maintenance modes do not help, as Sansec points out, because PHP parses the request before the application reads its maintenance flag.

• Set session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart every worker. Setting it through ini_set() or .user.ini has no effect on this bug.
• Set memory_limit=-1 where applications cannot override it, and use a container or cgroup memory limit to protect the host. The advisory warns against using RLIMIT_AS or RLIMIT_DATA instead.
• Lower post_max_size to 8M on sites with no uploads, or 32M where uploads are needed, with upload_max_filesize below it.
• On PHP 8.5, set fatal_error_backtraces=0.

; e.g. /etc/php/8.3/fpm/pool.d/www.conf
php_admin_flag[session.upload_progress.enabled] = off
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M

CERT-EU's advice for anything that cannot be patched or mitigated is to remove it from the public internet until it can be. Cloudflare calls its WAF rules a stopgap, and they only protect origins that refuse traffic arriving from outside Cloudflare.

Upgrade and verification on Debian, Ubuntu and RHEL-family servers

Find every PHP build that serves web traffic. The CLI binary often differs from the one PHP-FPM or Apache loads, and cPanel, Plesk and similar panels install several versions side by side.

# Debian / Ubuntu
dpkg -l | grep -E '^ii\s+(php[0-9.]*-(fpm|cgi|common)|libapache2-mod-php)'

# RHEL, AlmaLinux, Rocky
rpm -qa | grep -E 'php.*-(fpm|common)'

# Running FPM masters (the config path shows the version)
ps -eo pid,cmd | grep 'php-fpm: master'

Distribution packages usually keep the old upstream version number and add backported patches, so php -v on a patched Ubuntu server will not print 8.3.36. Check the package changelog for the CVE numbers instead, then restart every PHP process, because running FPM workers and Apache children keep the old code in memory.

apt changelog php8.3-fpm | grep -E 'CVE-2026-10961[89]'
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'

systemctl restart php8.3-fpm   # repeat for each installed version
systemctl restart apache2      # mod_php; httpd on RHEL

Signs of compromise to check after patching

The CVE numbers were public for almost a day before the fix shipped. On internet-facing servers, look for:

• PHP files created or changed since October 20: find /var/www /home -name '*.php' -newermt '2026-10-20' -type f
• shells, curl or wget processes whose parent is php-fpm, httpd or apache2
• new crontab entries or SSH keys for the web server user
• new administrator accounts in WordPress, Magento or other CMS user tables
• FPM worker crashes or memory-exhaustion errors in the logs around large multipart POST requests

Do not test servers with proof-of-concept code from social media. Tenable and Phoenix Security have both warned that exploit bundles circulating this week are unverified and may carry malware.

On the servers Falcon Internet manages, we restart every PHP-FPM pool after a PHP package update and confirm the running version before marking a server patched.