RCE Vulnerabilities in PHP 8.2 through 8.5

Source context: this article examines information published by the source on October 23, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Three vulnerabilities have been identified in PHP that can lead to unauthenticated remote code execution (RCE):

• CVE-2026-109618: This involves memory corruption during out-of-memory (OOM) handling. The vulnerability occurs when longjmp() is used to abort requests exceeding the memory_limit, potentially interrupting PHP while internal request data is partially initialized. Cleanup processes may then treat uninitialized memory—which could contain attacker-controlled data from previous allocations—as valid.
• CVE-2026-109619: This vulnerability stems from stale global state that survives after backing memory is freed (e.g., following a fatal error). A subsequent request handled by the same worker may utilize this stale state before normal initialization occurs.
• CVE-2026-115560: An RCE vulnerability affecting applications configured in an unusual way. Technical details have not yet been released; PHP will provide a full advisory with the next release.

Exposure and applicability

The vulnerabilities affect the following versions:
* PHP 8.5 (prior to 8.5.12)
* PHP 8.4 (prior to 8.4.27)
* PHP 8.3 (prior to 8.3.36)
* PHP 8.2 (prior to 8.2.35)
* End-of-life branches (PHP 8.1 and older)

All installations serving web requests are at risk, including PHP-FPM, php-cgi, FrankenPHP, LiteSpeed, and Apache with mod_php. The PHP team identifies mod_php as the highest-risk configuration for CVE-2026-109619. Additionally, third-party commercial or open-source products embedding PHP may be impacted.

Remediation priorities

Our analysis suggests prioritizing remediation based on deployment architecture and exposure:

1. Immediate Patching (Primary Fix)
Update to the following versions to fully resolve these vulnerabilities:
* PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
* For EOL versions (7.4, 8.0, 8.1), apply minimal source backports provided by the PHP security team or vendor-specific backports.

2. Temporary Exposure Reduction (When patching is delayed)
If immediate updates are not feasible, we recommend these configuration changes to block known attack paths:
* For CVE-2026-109618: Set memory_limit=-1 via php_admin_value (to prevent application overrides). Reduce post_max_size (e.g., 8M or 32M) and ensure upload_max_filesize remains below this value.
* For CVE-2026-109619 & CVE-2026-115560: Set session.upload_progress.enabled=0 in php.ini, FPM pools, or server configurations. This must be followed by a restart of all workers.
* For PHP 8.5 (CVE-2026-109619): Additionally set fatal_error_backtraces=0 and restart workers to block the confirmed fatal backtrace path.

How to validate remediation

To verify that exposure has been reduced or eliminated, defenders should use the following evidence:
* Version Verification: Confirm the installed PHP binary matches the remediated versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35). Note that a version check alone does not prove security if custom builds or unpatched third-party embeddings are used.
* Configuration Audit: For temporary mitigations, verify the active configuration via phpinfo() or by inspecting the FPM pool/Apache config files to ensure session.upload_progress.enabled is explicitly 0 and memory_limit is -1.
* Process Validation: Confirm that all PHP worker processes were restarted after configuration changes were applied; otherwise, stale state may persist in memory.

Limits and open questions

Temporary mitigations do not fully fix the vulnerabilities; they only block specific known attack paths. For example, setting memory_limit=-1 removes the controllable limit failure, but underlying allocation failures could still trigger the vulnerable code path. Similarly, disabling session upload progress blocks confirmed paths but may not stop all variants of the stale state vulnerability.

Furthermore, RLIMIT_AS and RLIMIT_DATA are not effective boundaries for this case, as they can actually trigger the vulnerable allocation failure. There is currently no technical detail available for CVE-2026-115560, leaving its specific triggers unknown until the next official PHP release.

Source and editorial note

Security Advisory 2026-018 · Source date: October 23, 2026 · Retrieved October 23, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment