PHP fixes two critical vulnerabilities enabling remote code execution

On October 21, 2026, the PHP team released updates fixing two critical vulnerabilities. They could allow code to be executed remotely without authentication. The risk affects PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

According to the PHP team, Apache configurations with mod_php are at greatest risk. The vulnerability descriptions include a scenario in which an unauthenticated request could trigger an attack before application code runs.

One vulnerability is related to an out-of-memory condition: handling it can interrupt PHP while internal request data is only partially initialized. Request cleanup may then mistake invalid data for valid data. The other occurs when internal request state persists after memory is freed and can be used by a later request handled by the same worker process, before normal reinitialization.

The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The project recommends that users update. Linux distribution and LTS providers received the patches in advance, so users should check for current packages with their provider.

The PHP project no longer releases updates for PHP 8.1 and older versions. For PHP 7.4, 8.0, and 8.1, the security team prepared minimal source-code fixes for those who build PHP themselves or do not have access to an LTS provider. Some distributions and LTS providers may release fixes for these versions separately.

Image:

Translation editors: Соловьев В., Пеков А.