PHP releases security updates, and how we are strengthening PHP security

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that under specific conditions could allow unauthenticated attackers to execute code remotely. CVE-2026-109618 comes from uninitialized data left behind when memory is exhausted, and CVE-2026-109619 comes from stale state pointing to the previous request's memory after a fatal error; both are in core paths such as memory management and error handling. The coordinated disclosure was leaked two days early, the CVE numbers circulated with an incorrect CVSS 10.0 (actual 9.2), and Chainguard released images containing the fix six hours before the coordinated release on October 21. The PHP Foundation said a 2024 external audit had found clues to the OOM issue, reports from Calif, OpenAI and Wiz in 2026 confirmed the full impact, and AI-assisted research has also increased the number of reports.