The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to fix two critical bugs that can let an unauthenticated attacker run code on a server. PHP's advisory urges all users to update immediately.
The flaw leaked before the official release. Cloudflare says it saw attack traffic aimed at its customers, and that free and paid WAF customers have been protected by default since 3:02 a.m. UTC on Oct. 21, about nine hours before disclosure. A firewall rule is not a patch, so update now.
What to update to
Move to the fixed release on your branch. Both bugs are fixed in each.
| Your branch | Update to | Note |
|---|---|---|
| PHP 8.5 | 8.5.12 | |
| PHP 8.4 | 8.4.27 | |
| PHP 8.3 | 8.3.36 | |
| PHP 8.2 | 8.2.35 | Reaches end of life Dec. 31, 2026 |
| PHP 8.1 and older | No upstream release | Ask your distribution or LTS vendor, or upgrade |
PHP says 8.1 and older no longer get updates from the project. For 7.4, 8.0 and 8.1 the security team published minimal source backports for people who build from source or lack an LTS vendor: branches PHP-7.4, PHP-8.0 and PHP-8.1 with the suffix -CVE-2026-109618-109619 in php/php-src.
Linux distributions and LTS vendors received the patches in advance. PHP adds that the volunteer-run Remi repository will not have updates on release day, and suggests distribution packages or a source build instead.
The two flaws
- CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is half set up, so cleanup treats invalid data as valid. Multipart request parsing can trigger it (GitHub advisory).
- CVE-2026-109619: request state can outlive its freed memory, and a later request on the same worker may use it (GitHub advisory).
Both are rated CVSS v4.0 9.2, per PHP's advance notice of Oct. 20.
Who is exposed
PHP says the risk covers all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
It rates the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. The GitHub advisory lists versions below the fixed releases as affected.
If a host manages PHP for you, check that it has applied the patch. If you run your own server, update the PHP package and restart your web server or PHP workers.
If you cannot update yet
PHP's advisory says only an update is a complete solution. These settings reduce exposure but do not make an installation safe.
- CVE-2026-109618: set
memory_limit=-1throughphp_admin_valuein the FPM pool or Apache config so apps cannot override it. Cappost_max_size(8M without uploads, 32M with). Use container or cgroup limits, notRLIMIT_ASorRLIMIT_DATA. - CVE-2026-109619: turn upload progress off by setting
session.upload_progress.enabledto0inphp.ini, the pool or server config, then restart every worker.ini_set()and.user.inido not work. On PHP 8.5, also setfatal_error_backtraces=0.
Why it matters
The harder case is anyone on PHP 8.1 or older: with no upstream release, safety depends on a vendor backport or a source build.
PHP 8.2 gets this fix, but its support ends Dec. 31, 2026, so plan the move to 8.3 or newer. For related coverage, see Windows Update's 2027 certificate rotation and what to check before One UI 9.
