🚨PHP Patches Two Critical Remote Code Execution Bugs
Your PHP apps are at risk if not updated
TL;DR
PHP has patched two critical vulnerabilities allowing unauthenticated remote code execution. CVE-2026-109618 and CVE-2026-109619 were already under attack, affecting every unpatched PHP version since 5.4. Operators must restart workers after updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
PHP has patched two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing unauthenticated remote code execution. These vulnerabilities were under active attack and present in every unpatched PHP version since 5.4. The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, rated 9.2 under CVSS v4.0. Operators must restart workers after updating to ensure security. This is a big deal for anyone running PHP in production, especially those using Apache mod_php or PHP-FPM.
Key Points
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP since version 5.4.
The vulnerabilities were fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, rated 9.2 under CVSS v4.0.
Cloudflare deployed WAF rules at 03:02 UTC on October 21, 2026, to mitigate the risks.
Apache mod_php and PHP-FPM are likely susceptible to the out-of-memory bug, requiring immediate action.
CVE-2026-115560 remains unpatched, adding another layer of complexity for operators.
Why It Matters
If you're running PHP in production, especially with Apache mod_php or PHP-FPM, this update is critical. The vulnerabilities allow unauthenticated remote code execution, affecting every unpatched PHP version since 5.4. Restarting workers after updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 is essential to mitigate risks.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,567 builders reading daily.