PHP developers have rushed out emergency patches after two critical flaws sent website operators scrambling and exposed a security problem first spotted in 2024.
According to Reuters, government websites in Europe and elsewhere went offline as administrators tried to protect servers from vulnerabilities capable of letting unauthenticated attackers execute code.
The fixes arrived on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities have a severity score of 9.2 out of 10.
The first, CVE-2026-109618, involves memory corruption during out-of-memory handling. The second, CVE-2026-109619, involves internal state surviving after its backing memory has been freed. Apparently, even discarded data refuses to leave quietly.
PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Developers consider mod_php the highest-risk configuration, with an attack demonstrated before application code even runs.
The PHP Foundation acknowledged that a developer found early signs of the memory-handling problem while addressing findings from a 2024 security audit.
Potential fixes threatened compatibility, performance or third-party extensions. Without a demonstrated attack, an overstretched team struggled to agree on an approach.
“The delay was a structural failure,” the foundation said, blaming decision-making processes and insufficient resources.
Researchers demonstrated remote code execution in August 2026, making the fix the foundation security team’s top priority.
Disclosure then became its own mess. Circulating vulnerability identifiers and a mistakenly published demonstration video helped force the planned release forward by a day.
The foundation says AI-assisted research is producing more reports, including invalid submissions and duplicates, while experienced engineers remain responsible for the decisions.
“A person makes every call and works on every patch,” it said. The foundation is asking companies dependent on PHP to fund more of those people.
CERT-EU advises organisations to patch immediately or isolate exposed applications until fixes are applied and verified.
Older PHP branches require particular attention. Some vendors provide backported fixes, and minimal source backports are available for PHP 7.4, 8.0 and 8.1. Configuration changes can reduce exposure, but only an update fully fixes the vulnerabilities.
