PHP patches released for two critical RCEs (lwn.net)
<p>The PHP project has <a
href="https://www.php.net/archive/2026.php#2026-10-21-5">published</a> PHP
versions <a href="https://www.php.net/archive/2026.php#2026-10-21-4">8.5.12</a>,
<a href="https://www.php.net/archive/2026.php#2026-10-21-3">8.4.27</a>, <a
href="https://www.php.net/archive/2026.php#2026-10-21-2">8.3.36</a> and <a
href="https://www.php.net/archive/2026.php#2026-10-21-1">8.2.35</a> to address
two critical vulnerabilities that could allow unauthenticated remote code
execution.</p>
<blockquote class="bq">
<strong>Who is at risk:</strong> all PHP installations serving web requests,
including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We
consider the risk highest for mod_php, with a demonstrated exploit where an
unauthenticated request can trigger the attack before any application code
runs.</p>
<p><strong>The vulnerabilities:</strong></p>
<ul class="spacylist">
<li><strong>RCE via OOM corruption</strong>, CVE-2026-109618 (<a href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w">GHSA-w8hw-w9fx-j79w</a>): out-of-memory
handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.</li>
<li><strong>RCE via stale global state</strong>, CVE-2026-109619 (<a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">GHSA-6wmf-4rv5-p3rp</a>): request-owned
internal state can survive after its backing memory has been freed. A later
request handled by the same worker may use that stale state before normal
initialization resets it.</li>
</ul>
</blockquote>
<p>PHP versions older than 8.1 will not receive updates from the project, though
the project has provided some patches for <a
href="https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619">PHP
7.4</a>, <a
href="https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619">PHP
8.0</a>, and <a
href="https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619">PHP
8.1</a> to assist in creating backports. According to the
announcement, Linux distributions and vendors received patches in advance, so
updated packages should be coming soon.</P>
href="https://www.php.net/archive/2026.php#2026-10-21-5">published</a> PHP
versions <a href="https://www.php.net/archive/2026.php#2026-10-21-4">8.5.12</a>,
<a href="https://www.php.net/archive/2026.php#2026-10-21-3">8.4.27</a>, <a
href="https://www.php.net/archive/2026.php#2026-10-21-2">8.3.36</a> and <a
href="https://www.php.net/archive/2026.php#2026-10-21-1">8.2.35</a> to address
two critical vulnerabilities that could allow unauthenticated remote code
execution.</p>
<blockquote class="bq">
<strong>Who is at risk:</strong> all PHP installations serving web requests,
including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We
consider the risk highest for mod_php, with a demonstrated exploit where an
unauthenticated request can trigger the attack before any application code
runs.</p>
<p><strong>The vulnerabilities:</strong></p>
<ul class="spacylist">
<li><strong>RCE via OOM corruption</strong>, CVE-2026-109618 (<a href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w">GHSA-w8hw-w9fx-j79w</a>): out-of-memory
handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.</li>
<li><strong>RCE via stale global state</strong>, CVE-2026-109619 (<a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">GHSA-6wmf-4rv5-p3rp</a>): request-owned
internal state can survive after its backing memory has been freed. A later
request handled by the same worker may use that stale state before normal
initialization resets it.</li>
</ul>
</blockquote>
<p>PHP versions older than 8.1 will not receive updates from the project, though
the project has provided some patches for <a
href="https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619">PHP
7.4</a>, <a
href="https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619">PHP
8.0</a>, and <a
href="https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619">PHP
8.1</a> to assist in creating backports. According to the
announcement, Linux distributions and vendors received patches in advance, so
updated packages should be coming soon.</P>
Comments