This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] PHP fixes 2 critical vulnerabilities

PHP (including SAPIs such as Apache mod_php, php-cgi, FrankenPHP or LiteSpeed) fixes 2 critical vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, 8.2.35 and backports for 8.1 [1], 8.0 [2] and 7.4 [3] [4]. If you cannot update immediately, below is a list of temporary mitigations, which however do not replace a proper update. For CVE-2026-109618, it is recommended to set the parameter memory_limit = -1, limit the size of multipart requests in PHP via the post_max_size parameter to the lowest possible value, implement additional limits at the web server or proxy level (for the size of the decoded request, the number of input fields, the number of multipart parts, the number of headers and the nesting depth), and use cgroups instead of RLIMIT restrictions for container memory management. Details can be found here [4]. For CVE-2026-109619, it is recommended to globally disable upload tracking (session.upload_progress.enabled = 0) in php.ini, the FPM pool or the server configuration, remove invalid or obsolete configuration settings that cause early warnings and handle crashes and timeouts that an attacker can trigger, and disable fatal_error_backtraces in PHP 8.5. Details can be found here [4]. Individual Linux distribution releases and their fixed versions: Ubuntu [5][6]: Stonking - 8.5.9-0ubuntu2.1 Resolute - 8.5.4-0ubuntu1.5 Noble - 8.3.6-0ubuntu0.24.04.13 Jammy - 8.1.2-1ubuntu2.28 Focal - 7.4.3-4ubuntu2.29+esm5 Bionic - 7.2.24-0ubuntu0.18.04.17+esm14 Xenial - 7.0.33-0ubuntu0.16.04.16+esm22 Trusty - 5.5.9+dfsg-1ubuntu4.29+esm18 Debian [7][8]: bookworm (security) - 8.2.35~deb12u1 trixie (security) - 8.4.27~deb13u1 Red Hat [9][10]: Red Hat Enterprise Linux 8 - fix available for php:7.4, details at [11]

PHP - RCE (CVE-2026-109618)
CVSS 9.2 (Critical)

Allows an unauthenticated remote attacker, by sending a specially crafted multipart HTTP request, to exhaust request memory, which due to faulty recovery may result in execution of arbitrary code with the privileges of the web server worker process [12].

The vulnerability is present in products:

  • *:PHP; <8.2.35; >=8.3.0, <8.3.36; >=8.4.0, <8.4.27; >=8.5.0, <8.5.12;
  • *:Wordpress; >=0;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 21. 10. 2026.

PHP - RCE (CVE-2026-109619)
CVSS 9.2 (Critical)

Allows an unauthenticated remote attacker, by sending a specially crafted sequence of HTTP requests, to gain unauthorized access to freed memory due to an unreset global PHP state, which may lead to data leakage or execution of arbitrary code with the privileges of the web server worker process [13].

The vulnerability is present in products:

  • *:PHP; <8.2.35; >=8.3.0, <8.3.36; >=8.4.0, <8.4.27; >=8.5.0, <8.5.12;
  • *:Wordpress; >=0;

CVSS: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 21. 10. 2026.

By CESNET, z.s.p.o. Ondrej Pavlovič on 21. 10. 2026.

CESNET, z.s.p.o. Logo