01
Disclosure
On 21 October 2026, PHP published security releases for every supported branch, addressing CVE-2026-109618[nvd-cve-2026-109618] and CVE-2026-109619[nvd-cve-2026-109619], each scored CVSS v4 9.2[php-changelog-8].
Identifiers and scores were confirmed against NVD and fixed versions against the php.net release index on 22 October 2026. The CVE pages query providers live and show what they return.
02
The PHP runtime
A PHP web application runs inside a runtime: typically PHP-FPM, a pool of long-lived worker processes. Each worker handles one request at a time, allocates memory for it, runs the application code, then resets before taking the next request.
03 · What went wrong
Normal request
A request arrives, a PHP worker takes it, allocates memory for that one request, runs the application, then cleans the memory before the next request. Each request should start from a clean state.
The problem
Certain fatal-error and out-of-memory conditions could leave internal PHP state in an unsafe condition. A later request handled by the same worker could encounter state that should no longer have been usable.
Why it mattered
That is a memory-safety failure. Depending on the affected path and environment, the disclosed vulnerabilities could allow severe outcomes, including exposure of sensitive memory and remote code execution.
The fix
PHP released patched versions for supported branches. The correct defensive action is to update to a fixed release. Unsupported branches need migration or vendor-maintained packages.
Conceptual explanation only. No payloads, request crafting or exploitation steps are published here.
04
Why core-runtime bugs matter
A plugin vulnerability affects sites that installed that plugin. A runtime vulnerability affects every application running on an affected build, whatever its framework and however good its code. Exposure depends on which PHP build is deployed, which is often decided by a base image or OS package rather than by the application's developers.
For scale: W3Techs reports PHP as the most common server-side language among websites whose server-side language it can identify[w3techs-php]. That measures detectable websites, not the whole Internet, and not how many are running an affected version.
05
AI-assisted discovery
Public accounts associate this discovery with AI-assisted research. We will attribute specific roles only after confirming primary sources[research-pending] (verification pending). Either way, the general point stands: discovery is getting cheaper, so remediation needs to get faster.
06
Coordinated response
Fixes shipped as coordinated releases across supported branches at disclosure[php-src-advisories]. Downstream, official container images[docker-php] and distribution packages then publish rebuilt artifacts. Every downstream step adds delay before an individual deployment is fixed.
07 · Fixed versions
- 8.5VULNERABLE < 8.5.12PATCH RELEASED 8.5.12latest on php.net: 8.5.12
- 8.4VULNERABLE < 8.4.27PATCH RELEASED 8.4.27latest on php.net: 8.4.27
- 8.3VULNERABLE < 8.3.36PATCH RELEASED 8.3.36latest on php.net: 8.3.36
- 8.2VULNERABLE < 8.2.35PATCH RELEASED 8.2.35latest on php.net: 8.2.35
- 8.1UNSUPPORTED: no upstream fix; migrate or use vendor-maintained packages
- 8.0UNSUPPORTED: no upstream fix; migrate or use vendor-maintained packages
- 7.xUNSUPPORTED: no upstream fix; migrate or use vendor-maintained packages
- 5.xUNSUPPORTED: no upstream fix; migrate or use vendor-maintained packages
Fixed versions per the PHP2Shell security releases [php-changelog-8] · support status [php-supported]
What version are you on?
Runs entirely in your browser against the published fixed-version table. Nothing is sent anywhere.
08
What maintainers should do
- Update to the fixed release for your branch (8.5.12, 8.4.27, 8.3.36, 8.2.35).
- Check where your runtime actually comes from: Dockerfile base image, compose file, CI image, OS package or hosting provider.
- Rebuild and redeploy images. Pinning a new version in a repository does nothing until it is deployed.
- If you are on 8.1 or older, plan a migration to a supported branch or confirm that your vendor backports fixes.
09
How our agent would respond
For each opted-in repository, the agent finds explicit pins such as FROM php:8.4.26-fpm and prepares an in-place bump to 8.4.27. It validates the diff, lets the repository's CI run, and opens a PR on a new branch. Floating tags are left alone, and unsupported branches are marked HUMAN REVIEW REQUIRED. See methodology.
10
Sources
- PHP releases (JSON release index): The PHP Group
- PHP 8 ChangeLog: The PHP Group
- Supported Versions: The PHP Group
- php/php-src security advisories: GitHub / The PHP Group
- CVE-2026-109618: NIST National Vulnerability Database
- CVE-2026-109619: NIST National Vulnerability Database
- Known Exploited Vulnerabilities Catalog: CISA
- Usage statistics of PHP for websites: W3Techs
- Docker Official Image: php: Docker Hub
- Choosing permissions for a GitHub App: GitHub Docs
- Third-party research write-ups (Wiz, Calif, Cloudflare, OpenAI): Various (verifying)