Patches released to address critical PHP vulnerabilities

Patches have been released to address two critical vulnerabilities in PHP, the widely used server-side language that underpins a large proportion of websites and web applications, including those operated by Australian businesses and their technology partners.

PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that can allow unauthenticated remote code execution (RCE). All PHP users are strongly encouraged to update immediately.

All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is considered highest for mod_php, where a demonstrated exploit allows an unauthenticated request to trigger the attack before any application code runs.

The first flaw, CVE-2026-109618, involves out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialised; request cleanup may then treat the invalid data as valid, enabling RCE.

The second flaw, CVE-2026-109619, involves stale global state. Request-owned internal state can survive after its backing memory has been freed, meaning a later request handled by the same worker may use that stale state before normal initialisation resets it — also enabling RCE.

The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) has recommended organisations identify PHP within their environments, review the latest guidance at php.net, apply available security updates and appropriate mitigations, and monitor PHP applications and related systems for suspicious activity.