PHP patches two critical remote code execution bugs rated CVSS 9.2
In brief
- Two PHP bugs allowed unauthenticated remote code execution, both rated CVSSv4 9.2 (critical).
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped Wednesday with the fixes.
- Apache mod_php servers face the highest risk, according to PHP.
- PHP runs about 70% of websites whose server-side language is known, per W3Techs.
Two bugs, one outcome
The first bug, CVE-2026-109618, shows up when PHP runs out of memory partway through handling a request and later treats the half-built data as if it were complete. The second, CVE-2026-109619, lets leftover data from one visitor's request stay in memory, where the next request can run into it.
Both end in the same place.
A stranger can run their own commands on the server without credentials (security researchers call this unauthenticated remote code execution). PHP said the risk is highest on servers using Apache's mod_php setup, where a demonstrated exploit works before any application code runs. PHP Foundation researchers also pointed to the upload-progress feature as one confirmed attack vector. It's been switched on by default for more than a decade, and few websites actually use it.
Why the footprint matters
PHP runs about 70% of all websites whose server-side language is known, according to W3Techs. Every WordPress site sits on a PHP server, per WordPress security firm Wordfence. Web host GoDaddy warned the flaws could let attackers steal data, deface sites or take over servers entirely.
How bad is 9.2? CVSS scores run from 0 to 10, and anything at 9.0 or above is labeled critical.
Patch timing
The PHP Foundation (the nonprofit that funds the language's development) raised the alarm on Tuesday, giving notice of a security release for Wednesday, October 21 at 14:00 UTC. The team said it'd ship earlier if details became public or there was evidence of active exploitation.
The fix landed at roughly 13:35 UTC on Wednesday, a few minutes early, as PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory's guidance didn't leave much room for interpretation.
"All PHP users are strongly encouraged to update immediately."
That's the PHP security advisory's own wording. Decrypt noted that releasing a fix isn't the same as having everybody apply it, and for anyone running PHP on the web, those four version numbers are the ones to check against.
Frequently asked questions
Which PHP versions fix the two critical vulnerabilities?
The fix shipped at roughly 13:35 UTC on Wednesday as PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security advisory told all PHP users to update immediately.
What do CVE-2026-109618 and CVE-2026-109619 actually do?
CVE-2026-109618 occurs when PHP runs out of memory partway through a request and later treats the half-built data as complete. CVE-2026-109619 lets leftover data from one visitor's request remain in memory, where the next request can run into it. Both allow unauthenticated remote code execution.
Which servers face the highest risk from the PHP bugs?
PHP said the risk is highest on servers using the Apache mod_php setup, where a demonstrated exploit worked before any application code ran. PHP Foundation researchers also identified the upload-progress feature, on by default for more than a decade, as one confirmed attack vector.
