The PHP project has released emergency updates for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing two critical vulnerabilities that allow an unauthenticated attacker to run code on servers running PHP. The PHP Foundation warns that if you run PHP, updating is imperative.
The flaws sit in memory management and error handling — parts of the engine that nearly every request touches. The main issue is tracked as CVE-2026-109618 and carries a CVSS score of 9.2, though a leaked score of 10.0 circulated before the official announcement. Exploits have been circulating since the night of October 20th after a leak in the coordinated disclosure process, making immediate patching urgent.
What is CVE-2026-109618?
According to the PHP Foundation, the root cause dates back to 2024, when an out-of-memory (OOM) problem was found during PHP's first external security audit in years. That audit was funded by the Sovereign Tech Agency through OSTIF and carried out by Quarkslab. A theoretical exploit was discussed at the time, but no concrete attack vectors were found.
Fixing the OOM problem proved extremely difficult. The security team developed several competing approaches, but each broke backward compatibility, introduced new denial-of-service risks, or required changes to many third-party extensions that seemed impossible to coordinate. Because the team works on consensus and lacked a known path to remote code execution, work stalled and restarted over months. The Foundation now describes the delay as a structural failure caused by the decision process and a lack of resources.
How the flaws were found and fixed
On August 11th, 2026, researcher Ryan A at security firm Calif reported an unconditional remote code execution with the same root cause as the OOM problem. OpenAI independently reported the same root cause the same day, followed by more attack vectors from OpenAI on September 18th and from Wiz on August 24th. Calif had begun auditing PHP on July 30th as part of the Patch the Planet program, and Trail of Bits has also been auditing the project.
