Security · October 24, 2026
PHP Foundation Addresses Serious Vulnerabilities
The PHP Foundation has revealed the timeline surrounding two serious vulnerabilities identified in PHP. Some issues were recognized in 2024, but resource shortages led to prolonged resolution efforts. There was confusion as information was leaked prior to an intended public announcement following coordination among stakeholders.
On October 21, 2026, an update was released to address the vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619, which allow remote code execution without authentication. The updates, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, are critical for users of PHP, who are urged to update immediately.
The foundation explained the circumstances leading to these fixes and the confusion that occurred during the information release. The vulnerabilities are related to memory management and error handling, which are utilized in nearly all requests, indicating a widespread and serious threat.
The signs of CVE-2026-109618 were noted during an external audit conducted in 2024, which pointed out another issue being addressed at that time. Although the potential for exploitation was anticipated, the exact attack vector was not identified, leading to prioritization of responses to other more specific issues.
U.S. authorities have advised immediate fixes for the PHP vulnerabilities, suggesting offline measures if difficulties arise. Additionally, there are updates for various other vulnerabilities across different platforms, emphasizing the ongoing need for vigilance in cybersecurity.