PHP 8.5.12 and Older Branches Patch Two Critical RCE Flaws

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 landed on October 21, 2026.

These updates patch CVE-2026-109618 and CVE-2026-109619. Both unauthenticated remote code execution vulnerabilities carry a CVSS v4.0 rating of 9.2. Researchers call the pair "php2shell". No complete mitigation exists, so you must update.

CVE-2026-109618 triggers when an out-of-memory condition interrupts PHP during partial initialization, leaving request cleanup to treat invalid data as valid. CVE-2026-109619 involves stale global state where request-owned internal state survives after freeing, allowing a subsequent request on the same worker to use it before initialization resets it.

The bugs hit any setup serving web requests, such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team states the risk is highest for mod_php due to a working exploit that fires from an unauthenticated request before application code runs. The vulnerable range spans PHP 5.4 through 8.5.11.

Patched releases cover only the four supported branches. PHP 8.5 and 8.4 receive active support, while 8.3 and 8.2 receive security fixes only. PHP 8.2 hits end of life on December 31, 2026, and versions 8.1 and earlier get no fixes. Upgrade PHP or pull vendor-patched packages, then restart services.