PHP Releases Patch for Critical Vulnerabilities

gray stainless steel padlock — Basil James / Unsplash

PHP has released patches to address critical vulnerabilities identified as PHP2Shell, which pose the highest risk to Apache with mod_php. The updated versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35, as previously announced. These patches fix a remote code execution vulnerability that affects nearly all usage patterns, with the Apache and mod_php combination being the most vulnerable.

The vulnerabilities are specifically categorized as CVE-2026-109618, which exploits memory exhaustion to allow PHP to interpret corrupted data as usable, leading to code execution, and CVE-2026-109619, which is a vulnerability that allows reading internal PHP values, where PHP may attempt to read memory again after it has been released.

For those unable to upgrade immediately, it is recommended to set memory_limit to -1 to allow PHP to utilize more memory, and to adjust post_max_size to a lower value, such as between 8-32MB. Additionally, session.upload_progress.enabled should be set to 0, and fatal_error_backtraces should also be set to 0. Users should not forget to restart all PHP workers.

Linux distributions have already received the patches in advance, indicating that updates should be released soon, while Docker users may need to wait a few more minutes.