PHP ships emergency fixes for critical remote-code-execution flaws

The PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, nicknamed PHP2Shell, that let an unauthenticated attacker run code on servers. One (CVE-2026-109618) is a memory-corruption bug triggered when a request hits PHP's memory limit at exactly the wrong moment; on Apache with mod_php it could be exploited before any application code even runs, and full remote code execution was demonstrated with default settings. The other (CVE-2026-109619) is a use-after-free bug where a fatal error leaves stale internal state that a later request on the same worker can exploit.

The PHP Foundation said the first bug was partly traced back to a 2024 external security audit, but fixing it stalled for months due to disagreements and limited staff, something the Foundation calls a structural failure it has since worked to fix by hiring dedicated security staff and using AI tools to help triage reports. Multiple security firms, including Calif, OpenAI, and Wiz, independently reported the same root cause in August.

The coordinated disclosure process broke down two days before the planned release: CVE numbers leaked online with an inflated severity score, pushing PHP to move its release up a day, and one partner firm, Chainguard, released patched container images more than six hours before the embargo lifted, letting anyone study the fix before most users could update. AWS separately found evidence of exploitation attempts as early as October 17, four days before public disclosure.

Why it matters

Two critical, easy-to-trigger PHP remote-code-execution bugs with evidence of pre-disclosure exploitation mean any unpatched PHP server is at immediate risk.

Source: The PHP Foundation