Critical PHP security update fixes two remote code execution flaws affecting web servers
PHP has released an emergency security update after technical details of two serious vulnerabilities surfaced online ahead of schedule. The release was moved up to Wednesday, October 21, at 2 p.m. UTC, following public discussion of the flaws a day earlier.
The patched versions are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. Administrators running PHP-powered websites, web applications, hosting platforms, NAS web services, or internal portals should treat this as a high-priority update.
Both vulnerabilities are located in the PHP interpreter itself, not in a specific CMS or plugin. That means the risk is not limited to WordPress, Drupal, Joomla, Laravel, Symfony, or any single web application. If the server runs a vulnerable PHP version in an exposed configuration, it may be at risk.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP rates both at 9.2 under CVSS 4.0, confirming that they can allow unauthenticated remote code execution with the privileges of the web worker process.
How the first PHP vulnerability works
The first flaw is tied to the way PHP handles out-of-memory conditions.
When PHP runs out of memory during request processing, the interpreter may use longjmp() to exit the current execution context. The problem is that this can happen while request memory is only partially initialized. During shutdown, PHP may then treat that incomplete state as valid, creating a path an attacker can abuse.
Researchers found that an attacker could intentionally trigger this condition using a specially crafted multipart request that remains under post_max_size. Possible techniques include sending an excessive number of headers per part, using empty file fields that do not count toward max_file_uploads, or relying on deeply nested field names.
The patch changes PHP’s behavior in this area. Instead of immediately jumping out of the current context, PHP now uses a softer out-of-memory response at the next safe point in the virtual machine. If memory pressure passes a second, higher threshold, the process exits more forcefully with _exit().
This change is designed to prevent PHP from continuing through shutdown with half-initialized memory structures.
The second flaw involves request-to-request memory state
The second vulnerability involves global state that can survive beyond a single request.
If a fatal error interrupts an operation before PHP properly resets its internal state, a global field may continue pointing to heap memory that has already been freed. When the next request lands on the same worker process and reads that value before normal initialization, the result can be a use-after-free condition.
PHP has confirmed two known paths for this issue. One involves the fatal_error_backtraces setting in PHP 8.5. The other involves session upload progress, a feature that is enabled by default and does not require the application itself to call session_start().
That second path is especially important because it can exist even when developers do not believe their application is actively using PHP sessions in the affected way.
Why Apache with mod_php faces the highest risk
Servers running Apache with mod_php are among the most exposed.
In this setup, Apache calls PHP’s request shutdown procedure even if request startup has already failed. That means an attacker may not need to reach the application’s code at all. Running PHP out of memory while it is still parsing the request body can be enough to trigger the vulnerable behavior.
PHP has validated full remote code execution against mod_php using default memory and input limits.
PHP-FPM behaves differently. If request startup fails, PHP-FPM kills the affected child process, which blocks the most direct exploitation route for the first flaw. However, PHP has still confirmed an exploit path against a standard PHP-FPM pool for the second vulnerability, although that route depends on a suitable application operation being present.
Source analysis also suggests that FrankenPHP may behave similarly to mod_php. LSAPI may be affected depending on configuration and runtime behavior.
The CVSS vector includes high attack complexity because exploitation reliability depends on factors such as the PHP build, the allocator, memory layout, and the target environment. Even so, the confirmed impact is severe enough that administrators should not rely on complexity as a defense.
Active exploit attempts have already been observed
Security researchers are already seeing exploitation attempts targeting both vulnerabilities.
watchTowr says it has observed active attempts in the wild. Cloudflare also reported seeing early attacks before the official patch release. At the time of reporting, no successful compromise had been publicly confirmed.
Even without confirmed breaches, several organizations treated the risk seriously. Dutch government services, including DigiD and MijnOverheid, were taken offline as a precaution. The UK’s National Cyber Security Centre has advised that unpatched systems should be taken offline if no safer mitigation is available.
The message for administrators is clear: if PHP is internet-facing and cannot be patched immediately, exposure should be reduced as quickly as possible.
AI helped researchers find and validate the flaws
Wiz Research discovered the vulnerabilities and reported them on August 24. According to Wiz, advanced AI systems helped during discovery, exploit development, and patch validation.
The researchers said AI was especially useful for tuning exploit behavior for different targets, where small environmental differences can affect reliability. Wiz also credited additional support from OpenAI and Calif during discovery and coordination.
This reflects a broader trend in cybersecurity. AI tools are increasingly being used by defenders to find vulnerabilities faster, but similar capabilities can also reduce the effort required by attackers. As exploitation techniques become easier to adapt, patch speed becomes even more important.
What website owners and server administrators should do now
The only complete fix is to update PHP.
Administrators should upgrade to one of the patched releases: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Linux distributions and long-term support vendors may backport the fixes into older package versions, so do not rely only on the visible PHP version number. Check the package changelog or security advisory for CVE-2026-109618 and CVE-2026-109619.
Older unsupported PHP branches, including 7.4, 8.0, and 8.1, are in a more difficult position. They may receive only limited source backports, and production systems should not depend on unsupported PHP releases for internet-facing workloads.
If immediate patching is not possible, PHP recommends setting memory_limit=-1 at the administrative level. This may sound counterintuitive, but the confirmed out-of-memory exploit depends on a predictable per-request memory ceiling. Removing that predictable limit can disrupt the known attack path.
Administrators should also disable session upload progress by setting session.upload_progress.enabled=0. On PHP 8.5 systems, fatal_error_backtraces should be set to 0 as well.
After changing these settings, restart all PHP workers and web server processes to ensure the new configuration is active.
If an application does not use multipart form uploads, administrators should consider blocking multipart requests at the frontend, reverse proxy, or web application firewall. This can reduce exposure to the known request patterns used in exploitation attempts.
These mitigations are not a full replacement for patching. They are temporary risk-reduction steps only.
Shared hosting, NAS devices, and managed environments need attention too
This issue does not only affect large web platforms. Shared hosting accounts, control panels, small business servers, home lab systems, and NAS devices with built-in web servers may also run vulnerable PHP versions.
If you use managed hosting, check whether your provider has applied the PHP security update. If your NAS or appliance includes a web server, review the vendor’s firmware or package updates. Many users do not realize PHP is running behind admin panels, media tools, file managers, or self-hosted applications.
Because these vulnerabilities affect the PHP interpreter itself, even a simple site may be exposed if the server accepts the wrong kind of request and runs a vulnerable configuration.
Bottom line
The latest PHP security update addresses two critical interpreter-level vulnerabilities that can lead to unauthenticated remote code execution. Apache mod_php deployments are especially exposed, but PHP-FPM and other runtimes are not automatically safe in every scenario.
Patch immediately, verify the CVE fixes in your packages, restart workers after mitigation changes, and reduce public exposure for any system that cannot be updated right away. For internet-facing PHP servers, this is not a routine maintenance update. It is an urgent security release.
