PHP Releases Critical Security Patches for Versions 8.2 through 8.5
The PHP Group has released emergency updates across four active versions to address two critical remote code execution vulnerabilities that affect all primary web-serving environments.
PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 shipped on October 21, 2026. These updates patch two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS v4.0 9.2. PHP 8.6.0 RC4 includes the same patches.
CVE-2026-109618 stems from out-of-memory handling that interrupts PHP during partial internal request initialization. CVE-2026-109619 occurs when request-owned internal state survives after freed backing memory. All web-serving PHP installations face risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with mod_php carrying the highest risk due to a demonstrated unauthenticated exploit.
Maintainers issued an advisory on October 23, 2026, advising administrators to set session.upload_progress.enabled=0 to close CVE-2026-115560. This RCE vector requires a specific setup where an application sets session.serialize_handler to php_binary or php_serialize, changes it to php via ini_set() before calling session_start(), and keeps session upload progress enabled.
Updating remains the only complete fix. Temporary mitigations for CVE-2026-109618 include setting memory_limit=-1 via php_admin_value, lowering post_max_size to 8M or 32M, and using container or cgroup limits. For CVE-2026-109619, mitigations include disabling session upload progress in server configuration and restarting workers, setting fatal_error_backtraces=0 on PHP 8.5, and fixing execution timeouts.
PHP 8.2 reaches end of life on December 31, 2026. PHP 8.1 and older receive no project updates, though minimal source backports exist for PHP 7.4, 8.0, and 8.1. PHP 8.6.0 RC5 is planned for November 5, 2026.