New Serious PHP Vulnerabilities Released and Patched

Critical vulnerabilities in the PHP runtime have been disclosed that permit unauthenticated remote code execution. The flaw affects every PHP installation that processes web requests, from shared‑hosting sites to large‑scale API back‑ends. Ignoring the patch means exposing servers to attackers who can run arbitrary commands before any application code runs.

Scope of the PHP RCE Vulnerabilities

The PHP security team released patches in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two separate CVEs. Both CVEs grant an attacker the ability to execute code without presenting credentials, a capability that bypasses typical authentication layers. The advisory stresses that “all PHP users are strongly encouraged to update immediately,” underscoring the universal exposure.

From a risk‑management perspective, the breadth of affected runtimes is alarming. PHP‑FPM, Apache with mod_php, php‑cgi, FrankenPHP and LiteSpeed all share the same core engine, so the flaw propagates across diverse deployment stacks. Organizations that rely on legacy PHP versions may find themselves unable to patch without a full upgrade, creating a pressure point for operational continuity.

Mechanics of the Out‑of‑Memory Corruption

CVE‑2026‑109618 (GHSA‑w8hw‑w9fx‑j79w) exploits a mishandling of out‑of‑memory (OOM) conditions. When PHP runs out of memory, it may abort the request while internal data structures remain only partially initialized. The cleanup routine then treats this incomplete data as valid, allowing crafted input to corrupt memory and trigger code execution.

This failure mode is subtle because it does not require a crafted payload that matches a specific function signature; the mere act of exhausting memory can open the door. Attackers can script repeated requests that force OOM, then inject malicious data that survives the incomplete cleanup, effectively hijacking the process.

Impact on Different Deployment Models

The second flaw, CVE‑2026‑109619 (GHSA‑6wmf‑4rv5‑p3rp), hinges on stale global state persisting after its backing memory is freed. A worker handling a request may later reuse that stale state for a new request before the normal initialization resets it. This “use‑after‑free” scenario is especially dangerous in long‑running processes such as mod_php, where a single exploit can compromise the entire Apache instance.

Conversely, short‑lived CGI processes reduce the window for reuse, but they are not immune. Any environment that pools workers—PHP‑FPM pools, LiteSpeed workers, or FrankenPHP’s async runtime—faces the same risk if the same process handles multiple requests. The advisory’s emphasis on mod_php reflects real‑world exploit demonstrations where the attack succeeded before any application code executed.

What This Actually Means For You

1. All servers running any of the listed PHP versions are exposed; there is no safe configuration shortcut.
2. The vulnerabilities bypass authentication, meaning that even hardened web applications cannot rely on login controls to block exploitation.
3. Long‑running worker models (mod_php, PHP‑FPM, LiteSpeed) present the highest practical risk because they reuse process memory across requests.
4. Applying the patches restores the integrity of request handling and eliminates the stale‑state and OOM pathways.
5. Delaying updates forces organizations to consider compensating controls—such as request throttling or memory limits—but these are stop‑gap measures, not fixes.

Immediate Action Steps

First, verify the current PHP version on every host using php -v. If any version predates 8.5.12, 8.4.27, 8.3.36, or 8.2.35, schedule an upgrade within the next maintenance window.

Second, apply the official patches from the PHP release archive, then restart all services that embed the interpreter (Apache, Nginx, LiteSpeed, etc.). Finally, run a quick smoke test—request a known endpoint and confirm the server returns the expected response without error.

Frequently Asked Questions

Can the PHP RCE bugs be exploited without sending malicious payloads?

Yes. CVE‑2026‑109618 can be triggered simply by exhausting memory, after which the incomplete cleanup treats attacker‑controlled data as valid, leading to code execution.

Do containerized PHP applications avoid these vulnerabilities?

Containers do not change the underlying PHP engine, so the same CVEs apply. However, container orchestration can make it easier to roll out patches across many instances quickly.

Is disabling mod_php a sufficient mitigation?

Disabling mod_php removes the highest‑risk deployment model, but the other runtimes (PHP‑FPM, php‑cgi, LiteSpeed) remain vulnerable. Full patching is still required.

What Do You Think?

Given the ease of remote exploitation, should organizations treat these PHP flaws as a top‑priority incident response trigger?