Patch PHP 8.2-8.5 servers to block unauthenticated remote code execution via critical CVEs

The PHP project released urgent updates today for multiple supported versions to address two critical security flaws that allow attackers to run arbitrary code on servers without logging in. System administrators must apply these patches immediately to protect their infrastructure from remote exploitation.

In plain English

These vulnerabilities exist in core parts of PHP that handle memory and errors during every web request. The first flaw, CVE-2026-109618, occurs when a request hits the memory limit at a precise moment. This timing issue leaves incomplete data in memory, which PHP later misinterprets as valid information. This corruption allows an attacker to inject and run their own code.

The second flaw, CVE-2026-109619, involves stale state left behind after a fatal error. If an error happens at the wrong time, internal pointers may reference memory from a previous request. A subsequent request handled by the same worker process can access this freed memory, leading to a use-after-free condition that enables remote code execution.

The background

Both issues were discovered following an external security audit conducted in 2024. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this review through OSTIF, with Quarkslab performing the audit. While a core developer contracted by the foundation was fixing an issue reported by Quarkslab, they identified the initial signs of the out-of-memory problem behind CVE-2026-109618.

Fixing these vulnerabilities was complex because they reside in central memory management and error handling routines. Developers had to resolve the flaws without breaking compatibility with existing applications, degrading performance, or forcing changes on the large ecosystem of third-party extensions that rely on PHP's internal structures.

What changes now

The PHP project has released version 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address these critical vulnerabilities. These updates are imperative for anyone running PHP servers, as the flaws allow unauthenticated remote code execution under default settings. The announcement on php.net provides technical details and update instructions for various systems.

Remote code execution was demonstrated against Apache with mod_php before any application code ran, using default settings. The exploit was also confirmed on PHP-FPM through application-level code paths. Because the flaws affect nearly every request, the risk is significant for all deployments that have not yet applied the latest patches.

Key terms explained

Remote code execution allows attackers to run commands on a server without permission. Use-after-free happens when software accesses memory that has already been released, often causing crashes or code injection. Memory corruption occurs when data is written to incorrect memory locations, leading to unpredictable behavior. Teams usually monitor for unusual process activity or unexpected network connections that might indicate exploitation. Check whether your server logs show signs of memory errors or unexpected worker crashes.

What to do and how to stay safe

• Check your current PHP version and compare it against the released updates for 8.2, 8.3, 8.4, and 8.5.
• Apply the latest security patches to all production servers running PHP as soon as possible.
• Review server logs for signs of memory limit errors or unexpected worker crashes that may indicate exploitation.
• Monitor network traffic for unusual outbound connections that could signal a compromised server.

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.