PHP Critical RCE Flaws Patched: Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 Now

PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says all users should update immediately, and that there are no complete mitigations, so updating is the only safe choice.

This follows our earlier post, Critical PHP Security Release on 21 October 2026, written before the details were public.

What the PHP Advisory Says

The PHP security advisory published on 21 October 2026 describes two flaws:

• CVE-2026-109618: remote code execution through out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partly initialised, and request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: remote code execution through stale global state. Request-owned internal state can survive after its memory has been freed, and a later request handled by the same worker may use it.

PHP says the issues affect all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php.

Fixed PHP Versions

• PHP 8.5: update to 8.5.12
• PHP 8.4: update to 8.4.27
• PHP 8.3: update to 8.3.36
• PHP 8.2: update to 8.2.35 (PHP 8.2 reaches end of life on 31 December 2026)

PHP 8.1 and older no longer get updates from the PHP project, although minimal source backports were provided for 7.4, 8.0 and 8.1, and some distributions and LTS vendors supply their own fixes.

Is It Being Exploited?

According to Help Net Security, Amazon Threat Intelligence recorded an exploitation attempt on 17 October 2026, four days before disclosure. The same report says Cloudflare has added initial WAF rules for known exploit vectors, which it presents as a partial measure and not a fix.

What to Do Now: 5 Steps

1. Check your PHP version. Look in your hosting control panel, or in WordPress under Tools → Site Health → Info.
2. Back up first. Follow our website backup guide.
3. Update PHP to a fixed version. On shared hosting, select the patched version in your control panel if it is available, or ask your host. On a VPS or dedicated server, install updated packages from your operating system vendor and restart PHP and your web server.
4. Test your site. Check the homepage, forms, checkout and admin login, and read the error logs.
5. Retire unsupported PHP. If you are on 8.1 or older, move to a supported release and update WordPress, themes and plugins to match.

Extra layers such as a DDoS protection service and good website security basics help, but they do not replace patching. Running your own server? Our VPS hosting page lists plans, and WordPress hosting is an option if you prefer not to manage PHP yourself.

Frequently Asked Questions

Which PHP versions fix the critical vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution.

Is there a workaround for the PHP vulnerabilities?

No. The PHP release notices state there are no complete mitigations and that updating is the only safe choice.

Is PHP 8.1 or older affected?

PHP 8.1 and older no longer receive regular updates from the PHP project. The PHP team provided minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors offer backported fixes. Ask your vendor or move to a supported version.

Are these PHP vulnerabilities being exploited?

Help Net Security reports that Amazon Threat Intelligence recorded an exploitation attempt on 17 October 2026, four days before public disclosure. Treat the risk as active and patch immediately.

Need Help Checking Your Site?

Not sure which PHP version your website runs or how to update it? Contact the Edish team for guidance.