PHP Releases Critical Security Updates for Two RCE Vulnerabilities; Issues Follow-Up Advisory
The PHP development team has issued a critical security alert after identifying two vulnerabilities that could allow unauthenticated attackers to execute code remotely on vulnerable servers. Security updates were released on October 21, 2026, followed by an additional advisory on October 23 concerning PHP’s session upload progress feature. Two Critical Vulnerabilities Identified The October 21 […]
The PHP development team has issued a critical security alert after identifying two vulnerabilities that could allow unauthenticated attackers to execute code remotely on vulnerable servers. Security updates were released on October 21, 2026, followed by an additional advisory on October 23 concerning PHP’s session upload progress feature.
Two Critical Vulnerabilities Identified
The October 21 security advisory addresses two vulnerabilities: CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale internal global state. Both flaws could potentially lead to remote code execution under affected conditions.
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team highlighted Apache mod_php as particularly concerning because an exploit has been demonstrated that can trigger an attack before application code executes.
Patched PHP Versions Released
To address the vulnerabilities, PHP released the following security updates:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The PHP team strongly recommends that users update to the appropriate patched release immediately. Users running older PHP versions should check with their operating system or hosting provider for available security fixes.
Follow-Up Advisory Issued on October 23
On October 23, PHP published an additional informational advisory concerning CVE-2026-115560, which involves a specific combination of session serialization settings and enabled upload-progress functionality.
The issue can occur when an application configures session.serialize_handler as php_binary or php_serialize, changes it to php at runtime using ini_set() before calling session_start(), and leaves session upload progress enabled.
As a precaution, PHP recommends disabling session upload progress until the next regular bug-fix release by setting:
session.upload_progress.enabled = 0Applications that already applied this mitigation following the October 21 advisory do not need to take further action for this recommendation. Applications that never change the serialization handler at runtime can keep upload progress enabled with respect to this specific issue.
PHP Users Urged to Review Security Updates
The PHP team advises administrators to prioritize security updates and verify that any temporary mitigations are correctly applied. The October 23 advisory is an additional precaution and does not replace the security updates released on October 21.
PHP 8.1 and older no longer receive security updates directly from the PHP project, although some vendors may provide backported fixes. PHP 8.2 is scheduled to reach end of life on December 31, 2026.
Administrators should consult the official PHP advisories and their vendors for further details.
Official sources:
- PHP Security Advisory β October 21, 2026
- PHP Session Upload Progress Advisory β October 23, 2026
- PHP Downloads
Stay updated with the latest technology and cybersecurity news at @w3buddy.
Written by
