PHP is widely used for server-side web development and is also bundled with other products and services. This means affected systems may include internet-facing websites as well as appliances, platforms, and services that include PHP.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

• 2 RCEs CE via OOM corruption, CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version. Additional update guidance provided by PHP: https://www.php.net/archive/2026.php#2026-10-21-5

The UK's National Cyber Security Centre's advisory advises that organizations unable to make the fix take websites offline. Government websites across the globe have begun going offline in precaution.