PHP patches two critical remote code execution flaws in all supported lines

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, rated 9.2 under CVSS 4.0 in the advance notice. CVE-2026-109618 lets an out-of-memory condition leave request data half initialised, which cleanup code may then trust. CVE-2026-109619 lets internal state from one request outlive its memory and be reused by a later request on the same worker. Both can lead to remote code execution without authentication, and every setup that serves web requests is affected, with mod_php named as the highest risk.

The project says updating is the only complete fix; configuration changes such as disabling session upload progress only narrow the exposure. PHP 8.1 and older get no official release, although source backports exist. PHP 8.2 reaches end of life on 31 December 2026.