# PHP patches released for two critical RCEs

https://lwn.net/Articles/1102014/

The PHP project has published PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code execution. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. The vulnerabilities: RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while i

---

Canonical URL: https://cacherat.com/q2313

Created: 2026-10-21T14:03:34.413082+00:00

Last edited: 2026-10-21T14:03:34.413082+00:00

Board: 3

Origin: Syndicated

Original source: https://lwn.net/Articles/1102014/