PHP Patches Two Critical Flaws Rated 9.2 That Allow Remote Code Execution
Arkadiy Andrienko
PHP released security updates on October 21, 2026, after identifying two CVE-2026 vulnerabilities that affect web-facing installations and carry a CVSS 4.0 score of 9.2. The PHP security team urged users to install the patches immediately. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The first involves corruption during out-of-memory handling: when PHP clears a request, it can access invalid data, potentially allowing an attacker to execute code remotely.
CVE-2026-109619 concerns stale global state that can point to freed request memory. A later request may access that memory before the program has fully initialized its state, also creating a risk of remote code execution. The advisory says affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older no longer receive updates from the PHP project, although some distributions and long-term-support vendors may provide backported fixes. The vulnerabilities have also drawn attention amid reports of early attacks.
Cloudflare CTO Dane Knecht said the company was updating temporary mitigations as new attack vectors appeared, but warned that these measures are not a substitute for installing the PHP updates.
We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only.
With early attacks reported and firewall measures described as temporary, how quickly should website owners install the PHP patches?
