The PHP Foundation has published a detailed account of the discovery and remediation process for two critical vulnerabilities in PHP that could allow remote code execution without authentication.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, involve core components related to memory management and error handling that are invoked by almost every request, giving them an exceptionally wide attack surface.
On October 21, 2026, the foundation released patched versions PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35 to resolve the issues. Organizations running any supported PHP branch are urged to apply the updates immediately.
Discovery Timeline and Remediation Challenges
One of the vulnerabilities, CVE-2026-109618, was first flagged during an external security audit conducted in 2024. Although the potential for exploitation was recognized at the time, the exact attack path remained unclear, and higher-priority issues took precedence due to limited resources.
Additional complications arose from the need to coordinate disclosure among multiple stakeholders while minimizing performance impact, resulting in a prolonged remediation effort.
The planned coordinated release was disrupted when details leaked ahead of the official announcement, creating further confusion in the community.
Security researchers and system administrators are advised to review the foundation’s advisory and verify that all PHP installations have been updated to the latest patched releases.
