From Thephp · · 2m
PHP Security Release Fixes Critical Vulnerabilities
PHP 8.5.12 and other updates patch critical code execution flaws found in two months.
In brief
PHP 8.5.12 and other updates patch critical code execution flaws found in two months. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix critical vulnerabilities allowing unauthenticated remote code execution. Originally reported by Thephp.
PHP Releases Critical Security Updates
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities.
Critical Remote Code Execution Vulnerabilities
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated attackers to execute code on PHP servers.
OOM Corruption Vulnerability
An out-of-memory corruption issue could leave partially initialized data behind, enabling remote code execution.
Stale State Vulnerability
A fatal error could leave internal state pointing to memory from a previous request, allowing remote code execution.
First External Security Audit
In 2024, PHP underwent its first external security audit funded by the Sovereign Tech Agency through OSTIF.
Security Team Decision Process
The PHP security team struggled to choose a fix for the OOM problem due to backward compatibility breaks and performance impacts.
Ecosystem Security Team Created
In May 2026, the PHP Foundation created the Ecosystem Security Team to handle triage and coordination.
AI Security Tools Added
The PHP security team added tools like OpenAI's Daybreak Red and Anthropic's Claude Mythos for vulnerability scanning.
Coordinated Disclosure Leak
On October 20th, the two CVEs leaked with incorrect release times and CVSS scores before the official announcement.
Chainguard Breaks Embargo
Chainguard unilaterally published built images with the fix on October 21st, breaking the coordinated disclosure embargo.
PHP Foundation's Security Improvements
The PHP Foundation now prioritizes faster resolution of complex security issues through improved processes.
Call for Sponsorship
Companies, hosting providers, and governments are urged to sponsor the PHP Foundation to fund security work.
Critical Infrastructure Impact
PHP runs government services, banks, and online stores, requiring urgent security updates.
Sponsorship Benefits
Sponsoring the PHP Foundation ensures sustainable security fixes for critical infrastructure.
The main idea
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix critical vulnerabilities allowing unauthenticated remote code execution.
