The PHP development team has released emergency security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute arbitrary code on affected web servers. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators are strongly urged to upgrade immediately.
Both vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2 under CVSS 4.0. They affect PHP installations handling web requests, including those running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
According to the official PHP security advisory, the highest risk is associated with Apache’s mod_php configuration, where researchers have demonstrated that an unauthenticated request can trigger an attack before any application code executes.
The first vulnerability, CVE-2026-109618, involves memory corruption during out-of-memory handling. Under certain conditions, PHP can interrupt request processing while internal structures are only partially initialized, potentially causing subsequent cleanup operations to access invalid data.
The second, CVE-2026-109619, concerns stale global state. Memory belonging to a previous request can be freed while references to it remain accessible, allowing a later request handled by the same worker process to interact with invalid memory.
Importantly, exploiting these vulnerabilities does not require a vulnerable PHP application or a publicly accessible file-upload feature. The problems originate in PHP’s internal request processing, making them particularly concerning for administrators hosting otherwise properly maintained applications.
Debian has moved quickly to address the vulnerabilities. The project issued DSA-6574-1, confirming that Debian 13 “Trixie” users can upgrade to PHP 8.4.27-1~deb13u1. Debian 12 “Bookworm” has received PHP 8.2.35-1~deb12u1 in its security repository, with both fixes explicitly listed in the package changelog.
The severity has also prompted an official warning from Arch Linux, which urges administrators running publicly accessible PHP applications to immediately upgrade to php 8.5.12 or php-legacy 8.3.36, depending on the installed package.
AlmaLinux technical steering committee has also approved releasing these fixes ahead of Red Hat and CentOS Stream. Patched packages are expected to reach testing repositories later today, followed by production repositories once testing is complete.
For other Linux distros, administrators should check their repositories for updated PHP packages. Distribution maintainers and long-term support vendors received the patches in advance to prepare security updates, including backported fixes where applicable.
PHP 8.1 and older versions are no longer supported by the upstream project, although some distributions may continue providing security patches. PHP 8.2, meanwhile, is approaching its end of life on December 31, 2026.
The PHP team also emphasizes that there are no complete workarounds for these vulnerabilities. Disabling session.upload_progress.enabled and restricting request sizes may reduce exposure to some attack paths, but these measures do not address every exploitation scenario.
Administrators should install the appropriate security update as soon as possible, and restart affected PHP workers or services to ensure the corrected code runs.
