What happened
The PHP project has released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, as described in the PHP Foundation’s write-up. Under the right conditions, both let an unauthenticated attacker run code on a server running PHP. The Foundation’s advice is plain: if you run PHP, update now.
The first flaw (CVE-2026-109618) involves a request hitting the memory limit at the wrong moment, which can corrupt memory. The second (CVE-2026-109619) involves a fatal error leaving state that points at memory from a previous request.
Why it matters
Both bugs sit in memory management and error handling, which nearly every request touches. According to the Foundation, the first can be triggered on Apache with mod_php before any application code runs, and code execution was demonstrated with default settings. It was also confirmed on PHP-FPM through application-level code paths.
For a team without a platform team, the risk is that PHP is often everywhere and owned by nobody: a WordPress site, an old internal tool, a Laravel app, a base image in a container that was built a year ago. Those are the places where patching slips. Internet-facing services deserve attention first, since the attacker needs no login.
What to do this week
- List every place PHP runs: servers, containers, CI images, legacy apps, and anything a vendor hosts for you.
- Check the version on each against the fixed releases for your branch (8.5, 8.4, 8.3 or 8.2). If you are on an older branch, check the php.net announcement for what applies to you.
- Rebuild and redeploy container images, not just the host packages. A patched host does nothing for an image with PHP baked in.
- Read the php.net announcement for update steps on your operating system, and check whether your distribution has shipped its own fixed package yet.
- Look at logs for unusual memory-limit errors, fatal errors or worker crashes before you patched. We cannot say these prove an attack, but they are worth a look.
Need a hand?
If you are not sure where PHP is running in your estate, or you want help patching and checking it without disrupting production, this is the kind of work our Security & Compliance service covers. We can help you build an inventory, plan the rollout and set up a routine so the next release is a small job. The first call is free and it is with an engineer.
Source: Today's PHP security release, and how we're strengthening security
Related service: Security & Compliance