# PHP Security Release Fixes Critical Vulnerabilities

> PHP 8.5.12 and other updates patch critical code execution flaws found in two months.
- Title: PHP Security Release Fixes Critical Vulnerabilities · Thephp
- Summary: PHP 8.5.12 and other updates patch critical code execution flaws found in two months. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix critical vulnerabilities…
- Keywords: php, php 8.5.12, php 8.4.27, php 8.3.36, php 8.2.35, cve-2026-109618, cve-2026-109619, remote code execution, security vulnerability, php foundation, sovereign tech agency, quarkslab
- Source: Thephp — https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security
- Read time: 1 min
- Topics: php, php 8.5.12, php 8.4.27, php 8.3.36, php 8.2.35, cve-2026-109618, cve-2026-109619, remote code execution, security vulnerability, php foundation, sovereign tech agency, quarkslab
## PHP Releases Critical Security Updates
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities.
## Critical Remote Code Execution Vulnerabilities
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated attackers to execute code on PHP servers.
## OOM Corruption Vulnerability
An out-of-memory corruption issue could leave partially initialized data behind, enabling remote code execution.
## Stale State Vulnerability
A fatal error could leave internal state pointing to memory from a previous request, allowing remote code execution.
## First External Security Audit
In 2024, PHP underwent its first external security audit funded by the Sovereign Tech Agency through OSTIF.
## Security Team Decision Process
The PHP security team struggled to choose a fix for the OOM problem due to backward compatibility breaks and performance impacts.
## Ecosystem Security Team Created
In May 2026, the PHP Foundation created the Ecosystem Security Team to handle triage and coordination.
## AI Security Tools Added
The PHP security team added tools like OpenAI's Daybreak Red and Anthropic's Claude Mythos for vulnerability scanning.
## Coordinated Disclosure Leak
On October 20th, the two CVEs leaked with incorrect release times and CVSS scores before the official announcement.
## Chainguard Breaks Embargo
Chainguard unilaterally published built images with the fix on October 21st, breaking the coordinated disclosure embargo.
## PHP Foundation's Security Improvements
The PHP Foundation now prioritizes faster resolution of complex security issues through improved processes.
## Call for Sponsorship
Companies, hosting providers, and governments are urged to sponsor the PHP Foundation to fund security work.
## Critical Infrastructure Impact
PHP runs government services, banks, and online stores, requiring urgent security updates.
## Sponsorship Benefits
Sponsoring the PHP Foundation ensures sustainable security fixes for critical infrastructure.
## Key takeaway

PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix critical vulnerabilities allowing unauthenticated remote code execution.