2026-10-21
[Breaking] Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), Japan's IPA and JPCERT/CC issue alerts: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now
On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), and urged all users to update immediately. CVE-2026-109618 involves out-of-memory handling and CVE-2026-109619 involves stale internal state surviving between requests; both are rated 9.2 under CVSS v4.0. All PHP installations serving web requests are at risk (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The team considers mod_php the highest risk, citing a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. PHP 8.1 and older get no official update; the team provided minimal source backports for 7.4, 8.0 and 8.1. Linux distributions received the patches in advance. There is no complete mitigation; updating is the only safe choice. On October 22, Japan's IPA and JPCERT/CC issued alerts and JVN published JVNVU#99905564. CISA said it had not observed exploitation as of its publication. No confirmed break-in had been announced as of 04:45 UTC on October 22. Many shared-hosting providers have announced that the fix is applied, but some have not yet. This site's take: confirm whether you or your provider updates PHP for each site and move to the fixed version today. On shared hosting, check your provider's completion notice on its official website.