Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. Anyone running PHP is urged to update immediately. The official announcement on php.net contains technical details and update instructions.
The first flaw, CVE-2026-109618, involves out-of-memory (OOM) conditions. If a request hits PHP's memory_limit at exactly the wrong moment, PHP can leave partially initialized internal data that is later treated as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. The second, CVE-2026-109619, is a stale-state issue: a fatal error can leave internal state pointing to memory from a previous request, enabling a use-after-free that was demonstrated against a real-world application.
Both issues sit in core areas of PHP that nearly every request touches: memory management and error handling. That central role made them serious and also difficult to fix without breaking compatibility, hurting performance, or forcing changes across the large third-party extension ecosystem.
The OOM problem was first spotted during a 2024 external security audit, funded by the PHP Foundation and carried out by Quarkslab. Fixing it stalled for months as the security team weighed competing approaches, each with trade-offs. The team acknowledges the delay was a structural failure, and it is changing its decision process, including majority voting. In May 2026 the PHP Foundation also created an Ecosystem Security Team to support triage, coordination, and hardening.
Source: Hacker News · Summarized by HeadlinesBriefing