PHP has pushed back its security release to Wednesday, October 21, at 2pm UTC, after details of two flaws were leaked to Hacker News the day before. The fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both bugs are found in the interpreter itself rather than in a CMS. The PHP advisories for CVE-2026-109618 and CVE-2026-109619 each rate 9.2 under CVSS 4.0 and confirm unauthenticated remote code execution with web worker privileges.
Insufficient memory management leaves memory half-initialized
The first flaw is how PHP handles out-of-memory errors. On OOM, the interpreter uses longjmp() to abandon the current context, even when the request memory is only partially initialized at that time. The shutdown procedure then reads that state as valid. An attacker can force OOM with a multipart request that remains below post_max_size, for example via an unlimited number of headers per part, empty file fields that do not count towards max_file_uploads, or nested field names. The patch replaces longjmp() with a soft OOM at the next VM safe point and a hard _exit() above a second higher threshold.
The second flaw concerns the global state that survives a request. If a fatal error interrupts an operation before its state is restored, a global field continues to point to the freed heap memory. When the next request on the same worker reads that value before normal initialization, the result is a use-after-free. PHP lists two committed paths, the fatal_error_backtraces setting in PHP 8.5 and session load progress, which is enabled by default and does not require the application to call session_start().
Because mod_php is the most exposed
Apache with mod_php calls the request termination procedure even when the request initiation has already failed. You simply run out of memory while PHP parses the request body, and you don’t need to run any application code. PHP validated complete code execution against mod_php with default memory and input limits. PHP-FPM kills a child whose startup fails, blocking the direct path. As for the second flaw, PHP has again confirmed an exploit against a normal FPM pool, although it depends on proper operation in the application. Source analysis suggests that FrankenPHP behaves like mod_php, while LSAPI is a conditional candidate. The high attack complexity in the CVSS vector reflects the fact that PHP build and heap layout affect reliability.
Exploit attempts and the role of artificial intelligence
watchTowr says it is seeing active exploitation attempts against both flaws, and Cloudflare told The Hacker News that it encountered early attacks before the patch shipped. So far, no successful compromise has been confirmed. Dutch government services, including DigiD and MijnOverheid, are still offline as a precaution, and the UK NCSC recommends taking unpatched systems offline if no other options are available.
Wiz Research found the bugs and reported them on August 24. According to Wiz, Gemini 4 Argon and GPT-5.6 Sol helped with discovery, exploit development, and patch validation, specifically with exploit tuning for each target. Wiz also credits OpenAI and Calif with helping with discovery and coordination. It fits with what Anthropic wrote recently about self-copying AI targeting cheap TVs, where the models also lower the level of attacks.
What administrators should do now
Updating is the only complete solution. Linux distributions and LTS vendors received patches early and often backport them with older version numbers, so check the changelog for CVE IDs rather than the version string. Unsupported 7.4, 8.0, and 8.1 branches get only minimal source backports. If you can’t upgrade right away, PHP recommends setting memory_limit=-1 administratively, since a predictable limit per request is what makes the confirmed OOM exploit work. Add session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, then restart each worker. If your application doesn’t use multi-part modules, block them in the frontend. None of these settings are a complete solution. On shared hosting or a NAS with a web server, check which PHP version your provider provides.
