PHP RCE vulnerabilities: patched versions and upgrade guide

Two critical PHP RCE vulnerabilities were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both can allow unauthenticated remote code execution, and both are rated CVSS v4.0 9.2. The PHP project says updating is the only safe choice.

This guide covers the patched versions, how exposure differs between Apache mod_php, PHP-FPM and other server APIs, and a rollout you can follow today. It contains no exploit details.

Sources checked on 26 October 2026. Advisories, prices and availability can change; confirm the linked primary sources before acting.

Which versions fix the PHP RCE vulnerabilities?

Every supported branch has a fixed release. Anything older than the version below is affected.

Branch	Fixed release	Windows rebuild (26 October)
8.5	8.5.12	8.5.12-1
8.4	8.4.27	8.4.27-1
8.3	8.3.36	8.3.36-1
8.2	8.2.35	8.2.35-1

The two issues are CVE-2026-109618 (memory exhaustion that corrupts state) and CVE-2026-109619 (stale global state). Their GitHub advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

Windows users need one more step. On 26 October the PHP project republished Windows packages with a -1 suffix for a Brotli decompression flaw (CVE-2026-111497). It is reachable through cURL when automatic response decompression is enabled.

Exposure differs by server API

Risk is highest on Apache with mod_php. The PHP project reports a demonstrated unauthenticated path there that runs before any application code.

PHP-FPM is conditionally exposed, and one path was validated against it. FrankenPHP and LiteSpeed are described as likely or conditional candidates. The release announcement covers all installations serving web requests, including php-cgi. Not demonstrated is not the same as safe.

Command-line PHP that never handles HTTP requests is not named. Treat every web-facing worker as in scope, including staging servers and forgotten admin hosts.

Interim measures while you schedule the upgrade

Interim settings reduce specific attack paths; they do not make a server safe. Use them only to bridge the hours before patched packages are live.

• Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration. Do not rely on ini_set() or .user.ini. Restart every worker.
• Limit request size at the reverse proxy, and lower post_max_size and input limits where the application allows.
• Block multipart requests at the front end if the application never accepts uploads.
• Remove diagnostics and fatal-error output from paths an attacker can reach.

The advisory also discusses memory_limit=-1 as a partial measure and warns against RLIMIT_AS or RLIMIT_DATA. Removing the memory limit has its own stability cost, so pair it with container or cgroup limits.

A safe upgrade workflow

Inventory first, then patch, restart and verify. Skipping the restart is the most common way a patch silently fails.

1. Inventory. Check php -v and php-fpm -v on each host. CLI and FPM packages can differ.
2. Back up. Snapshot the server or image and the database before changing packages.
3. Patch. Confirm your package source (distribution, PPA, Docker image or Windows build) already ships the fixed release.
4. Restart every PHP process. Reload FPM pools and Apache; a long-lived worker keeps the old code in memory.
5. Verify. Check the version each pool reports, run smoke tests and watch error logs.

For Docker, rebuild from an updated php base tag and redeploy. Our PHP 8.5.11 security release checklist covers the same restart-and-verify routine.

Laravel and WordPress compatibility checks

These are patch releases within each branch, so code changes are not expected. Test before production anyway.

For Laravel, run the test suite on the new binary, then restart Horizon or queue:work processes so they load it. For WordPress, confirm plugins load, scheduled tasks run and uploads still work. Still on 8.2? Plan the branch move with our PHP 8.2 end-of-life checklist.

Our verdict: patch web-facing PHP today, starting with any mod_php host. If you need a version audit or emergency patching across several servers, our Laravel and PHP development team and maintenance and support service can help.

Sources and further reading

• PHP security announcements, October 2026 — PHP
• RCE via OOM corruption (GHSA-w8hw-w9fx-j79w) — PHP on GitHub
• RCE via stale global state (GHSA-6wmf-4rv5-p3rp) — PHP on GitHub

Image credits

Explanatory diagrams: Cloudsoft Zone, CC BY-SA 4.0. Featured photograph: Atomic Taco from Seattle, WA, USA, CC BY-SA 2.0, via Wikimedia Commons. Technician with laptop working on server rack at NERSC: Derrick Coetzee from Berkeley, CA, USA, CC0, via Wikimedia Commons.