On October 21, 2026, the PHP Foundation published a security update that fixes two critical remote code execution (RCE) vulnerabilities. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The foundation's advice is direct: "it is imperative that you update now".
CVE-2026-109618 is a memory corruption caused by running out of memory (OOM). Remote execution was demonstrated on Apache with mod_php in a default configuration and confirmed on PHP-FPM through application-level code paths. CVE-2026-109619 is stale global state after a fatal error, leading to use-after-free, with RCE demonstrated against a real application on Apache with mod_php. The correct CVSS score is 9.2; a wrong score of 10.0 briefly circulated.
According to the PHP Foundation, the first signs of the OOM problem showed up in 2024, when a PHP core developer was fixing an issue reported by Quarkslab in the external audit. On August 11, 2026, Ryan A of Calif reported unconditional RCE with the same root cause, and OpenAI reported the same cause the same day. On August 24, Wiz reported another attack vector.
Simon Willison, who commented on the announcement, says exploits had been circulating since the night before because of a leak in the coordinated disclosure process. For teams running PHP, the practical step is to check the version in use and move to one of the fixed lines. The foundation also listed measures to strengthen its security process, such as majority-based decisions and more engineers with deep knowledge of the codebase.
Original source: The PHP Foundation
Other references: