Overview
- The PHP project published security releases for maintained branches on Wednesday, October 21, 2026, providing fixes as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two critical bugs.
- The flaws are two memory-management vulnerabilities tracked as CVE-2026-109618, which involves resource-exhaustion memory handling, and CVE-2026-109619, which allows use of data after its memory has been freed, and both can enable unauthenticated remote code execution.
- Researchers from Calif and OpenAI privately reported the bugs in August and coordinated with PHP maintainers, while security firm Wiz later described additional exploit techniques and a public leak the day before the planned disclosure widened the window for attacks.
- National cyber agencies including the U.S. NSA, CERT-EU and the UK NCSC have told organizations to install the patches immediately or take vulnerable systems offline, and many governments and large services temporarily disconnected public sites such as national portals, Wikimedia systems and parts of major broadcasters while they patched.
- Patches are available but risk remains because the early leak and AI-assisted exploit development speed up attacks; administrators should confirm updated PHP versions, check server logs for signs of intrusion and plan migrations for older branches that approach end of support.