Remote Code Execution Vulnerabilities in PHP 8.2 through 8.5

Source context: this article examines information published by the source on October 21, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Two critical vulnerabilities have been identified in PHP that allow unauthenticated remote code execution (RCE).

CVE-2026-109618 involves memory corruption during out-of-memory (OOM) handling. The flaw occurs when PHP uses longjmp() to abort requests exceeding the memory_limit. This can interrupt the process while internal request data is partially initialized—such as during form-based file uploads—leading the cleanup process to treat invalid data as valid and attempt to free uninitialized memory that may contain attacker-controlled data.

CVE-2026-109619 involves a stale global state. Internal request state can survive after its backing memory is freed (for example, following a fatal error). A subsequent request handled by the same worker may utilize this stale state before normal initialization resets it.

Exposure and applicability

The vulnerabilities affect the following versions:
* PHP 8.5 < 8.5.12
* PHP 8.4 < 8.4.27
* PHP 8.3 < 8.3.36
* PHP 8.2 < 8.2.35
* End-of-life branches (PHP 8.1 and older)

Any installation serving web requests is at risk, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. The highest risk is associated with mod_php configurations. Because many commercial and open-source products embed PHP as a backend technology, these third-party applications may also be exposed even if they do not directly expose a standalone PHP installation.

Remediation priorities

Our analysis recommends prioritizing remediation based on the exposure of the asset to public networks.

1. Primary Patching Path
Update all affected installations to the following versions:
* PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

For those using end-of-life versions (PHP 8.1 and older), users should upgrade to a supported version or apply minimal source backports provided by the PHP security team for versions 7.4, 8.0, and 8.1.

2. Temporary Exposure Reduction
If immediate patching is not feasible, the following configuration changes can reduce exposure to specific attack paths but do not fully resolve the vulnerabilities:

• For CVE-2026-109618: Set memory_limit=-1 via php_admin_value (to prevent application overrides). Additionally, set a low post_max_size (8M for no uploads; 32M if required) and ensure upload_max_filesize remains below post_max_size.
• For CVE-2026-109619: Set session.upload_progress.enabled=0. For PHP 8.5 installations, set fatal_error_backtraces=0. Both actions require a restart of every worker to take effect.

How to validate remediation

Verification must go beyond simple version checks to ensure the fix is active in the running environment:

• Patch Verification: Confirm that the binary in use matches the patched versions listed above. For those using distribution packages, verify through the vendor’s package manager that the specific security update has been applied.
• Configuration Validation: If temporary mitigations were used, verify that memory_limit is indeed set to -1 and that session.upload_progress.enabled is 0 via a phpinfo() check or by inspecting the active FPM pool/Apache configuration. Ensure these settings are applied at the administrative level (php_admin_value) rather than the user level (ini_set), as the latter may be bypassed.
• Worker State: Confirm that all worker processes have been restarted following any configuration change to clear stale global states.

Limits and open questions

Temporary mitigations are not comprehensive. Setting memory_limit=-1 removes the controllable memory limit failure, but an underlying system allocation failure could still trigger the vulnerable code path. Similarly, disabling session upload progress blocks confirmed paths for CVE-2026-109619 but does not block all potential variants.

Residual risk remains high for any installation that has not been patched to the specified versions. Furthermore, hiding diagnostics via display_errors or error_reporting provides no protection against these vulnerabilities.

Source and editorial note

Security Advisory 2026-018 · Source date: October 21, 2026 · Retrieved October 21, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment