Skip to content

PHP ships the fix for the RCE already under attack

php.net confirms CVE-2026-109618 and CVE-2026-109619 and names the patched versions, hours after attackers started exploiting the bugs unpatched.

Source: PHP

PHP released its scheduled security update on 21 October at 14:00 UTC, fixing the two remote code execution bugs attackers had already been exploiting for hours. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

php.net’s own advisory confirms CVE-2026-109618, an out-of-memory handling bug that lets request cleanup treat invalid data as valid, and CVE-2026-109619, where stale internal state from one request survives to be used by the next on the same worker. Both reach any PHP install that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all named. PHP 8.1 and earlier do not get this fix at all, since the project no longer supports them.

Why it matters: this confirms, with an official source and real version numbers, what was only a leaked and unconfirmed report a few hours earlier. Upgrade to the patched point release on whichever line you run, today, not on your next normal deploy. If you’re still on 8.1 or older, there is no vendor fix coming, so a WAF rule or network-level block is not a stopgap, it’s the only mitigation you get.

The caveat: the advisory covers PHP itself, not the frameworks and CMSes built on it. WordPress, Laravel, Drupal and similar still need their host’s PHP binary updated separately; updating the application alone does not close this.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

Engineering

The N+1 you cannot see

Everyone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy. There is a one-line switch that finds all of them.

Engineering

Queues are not optional

If your request handler calls somebody else’s API, you have already built a distributed system. The queue is how you stop their bad day from becoming your bad day.

More from The Wire

All briefs