PHP patches two critical remote code execution flaws after a leak forces an early release
If you run PHP, update. The Foundation post is a frank account of how a 2024 lead stalled and how the disclosure unraveled.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 (out-of-memory handling leaves request data half-initialized) and CVE-2026-109619 (state from a freed request is reused by a later one). The PHP project says every installation serving web requests is at risk, mod_php most of all, and urges an immediate update; it also published minimal backports for PHP 7.4 to 8.1.
The PHP Foundation says the first signs of the memory bug surfaced during a 2024 audit, but work on a fix stalled, which it calls a structural failure. Reports from Calif, OpenAI and Wiz in August made the impact clear. After the CVE IDs leaked on October 20, the release was moved up a day; security firm Calif mistakenly published a demo video, and the Foundation says Chainguard broke the embargo by publishing fixed images hours early.
Three Hacker News threads (the top one 1,549 points) argued over embargoes versus releasing fixes at once, Chainguard's move, and admins racing to patch or shut servers down.
-
Coordinated vulnerability disclosure
After exploring Today's PHP Security Release, and How We're Strengthening PHP Security, to see why the embargo mattered so much, read about Coordinated vulnerability disclosure.
The disclosure model in which a flaw is made public only after the responsible parties have had time to fix it, as opposed to full disclosure.
Wikipedia · Wade · 5 min
0 -
Dangling pointer
After exploring PHP: News Archive - 2026, for the class of bug behind the second flaw, try Dangling pointer.
Pointers that no longer point to a valid object, a kind of memory safety violation behind use-after-free bugs.
Wikipedia · Swim · 30 min
0