NEWS
Technology

Critical RCE Flaws Fixed in PHP Across All Supported Branches; Immediate Patching Urged

Published:
Updated:
Critical RCE Flaws Fixed in PHP Across All Supported Branches; Immediate Patching Urged

Two Critical Flaws Allow Unauthenticated Code Execution

The PHP security team has released patched versions across all active release branches—PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—to address two critical vulnerabilities that allow unauthenticated remote code execution (RCE). The vulnerabilities affect all installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The team noted the highest risk exists for Apache with mod_php, where demonstrated exploits trigger before application-level code executes.

  • CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): Out-of-memory handling can interrupt internal request initialization, causing subsequent cleanup routines to treat corrupted state as valid.
  • CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): Request-owned internal state can persist across worker cycles after memory is freed, allowing subsequent requests on the same worker to access stale pointers.

Upgrade Actions and Temporary Mitigations

Administrators should immediately deploy PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Due to the severity, official minimal source-backports have also been made available for legacy releases (PHP 7.4, 8.0, and 8.1). System operators using third-party repositories like rpms.remirepo.net are advised to switch to distribution vendor packages or compile directly from source, as repository updates may be delayed.

For systems unable to update immediately, partial mitigations include:

  • Mitigating CVE-2026-109618: Set memory_limit = -1 via non-overridable server configurations (php_admin_value) and restrict post_max_size to 8M (or 32M when file uploads are required).
  • Mitigating CVE-2026-109619: Set session.upload_progress.enabled = 0 prior to request parsing, set fatal_error_backtraces = 0 on PHP 8.5, and restart all worker processes.