TBNSecurity
New Serious PHP Vulnerabilities Released and Patched
Publication: Schneier on Security
Author: Bruce Schneier
Source published: 22/10/2026, 13:26:51 UTC
Briefing created: 22/10/2026, 14:46:19 UTC
Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 22/10/2026, 14:45:24 UTC.
Briefings
PHP maintainers released critical security fixes for four vulnerable PHP versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) addressing remote code execution via out-of-memory corruption and stale global state. The risk is highest for mod_php, where an unauthenticated request can trigger attacks before application code executes. All PHP installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Immediate updates are strongly recommended to prevent unauthenticated remote code execution.
Key points
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain critical remote code execution vulnerabilities exploitable via out-of-memory corruption and stale global state.
- The risk is highest for mod_php, where an unauthenticated request can trigger attacks before any application code runs.
Context
PHP maintainers released fixes for two critical vulnerabilities affecting PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, allowing unauthenticated remote code execution through out-of-memory corruption and stale global state. The risk is highest for mod_php, where an unauthenticated request can trigger attacks before any application code runs. All PHP installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Immediate updates are strongly recommended to prevent unauthenticated remote code execution.
Limitations
Evidence covers only the four specific PHP versions mentioned; other versions are not explicitly assessed. The exploit demonstration for mod_php is described as demonstrated but not universally replicated. No specific update dates beyond the publication date are provided, and the scope of affected applications beyond the listed types is limited.
Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 22/10/2026, 14:46:19 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.
View archived briefing on IPFS
bafybeifrngpmu2hmvxnqoclylzbbbupqydek4i2wctefdnubtp7mkztysq