Tech

PHP patches released for two critical RCEs

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 21/10/2026, 14:50:24 UTC.

Briefings

PHP project released security patches for two critical remote code execution vulnerabilities affecting PHP 8.2 through 8.5. CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) allows RCE via OOM corruption, while CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) enables RCE through stale global state. Risk is highest for mod_php, where unauthenticated requests can trigger attacks before application code executes. No patches exist for PHP versions older than 8.1, though some backports were provided for 7.4, 8.0, and 8.1. Linux distributions and vendors received patches in advance, suggesting updated packages are imminent.

Key points

• PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical RCE vulnerabilities.
• CVE-2026-109618 allows RCE via OOM corruption, while CVE-2026-109619 enables RCE through stale global state.

Context

PHP vulnerabilities affecting web servers are critical, as unauthenticated requests can trigger attacks before application code executes. The project addressed two specific CVEs in PHP 8.2+ versions, with mod_php having the highest demonstrated risk.

Limitations

Patches provided for older PHP versions (7.4, 8.0, 8.1) are limited to backports; no patches exist for versions older than 8.1. Linux distribution vendors received patches in advance, but specific update timelines remain uncertain.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 21/10/2026, 15:10:05 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeihzqpuqgt5caicwjj62lihoo3oz3pddgu24v2ctlqyjeqta4btale