What the researchers found
The PHP project published two critical memory-safety advisories on 21 October 2026, each rated 9.2 under CVSS 4.0. One concerns interrupted out-of-memory handling and unfinished request data. The other concerns references to request memory that outlive the memory itself and can be used by a later request.
The advisories credit the original reporters and PHP remediation developers. Bytova provides educational tools and guidance; it makes no discovery claim.
Sources: PHP: RCE via OOM corruption · PHP: RCE via stale global state.
What remote code execution means
Remote code execution (RCE) means an attacker may cause a server to execute attacker-controlled instructions. The demonstrated PHP impact runs with the web worker account’s permissions. Depending on that account’s access, consequences can include altered pages, exposed application data, stolen application secrets or interrupted services. It does not automatically mean administrator or root access.
PHP reports a complete unauthenticated exploit against Apache mod_php. Other web PHP handlers also require assessment; differences in demonstrated exploit reliability are not a reason to leave an affected runtime unpatched.
Sources: PHP: RCE via OOM corruption · PHP official security announcement.
Who needs to act
Administrators of PHP-backed websites, APIs, WordPress and other PHP applications should identify their actual runtime and package source. Check hosting services and appliances that bundle PHP as well as servers you manage directly. A static HTML website does not itself run PHP; linked services and other infrastructure still need their own assessment.
Updating WordPress, a theme or a plugin alone does not replace a PHP runtime update. Ask your host who manages PHP, which package revision includes both fixes and when the running workers were replaced.
Sources: UK NCSC: Critical security issue affecting PHP · Cloudflare: observed attack traffic and WAF protections.
Verified releases and vendor backports
| PHP branch | Fixed release | PHP-project security support ends |
|---|---|---|
| 8.2 | 8.2.35 | 2026-12-31 |
| 8.3 | 8.3.36 | 2027-12-31 |
| 8.4 | 8.4.27 | 2028-12-31 |
| 8.5 | 8.5.12 | 2029-12-31 |
These are verified fixed upstream releases, not a promise that the snapshot always lists the newest release. PHP 8.1 and older have no PHP-project security support. Maintained distribution or LTS packages may have their own backports: do not judge those packages by the upstream number alone.
The checker can recognise selected exact Ubuntu and Debian package fixes. Everything else requires the vendor’s records. Newer, unreviewed releases and build suffixes return an unverified result.
Sources: PHP official security announcement · PHP upstream support calendar · Ubuntu package status: CVE-2026-109618 · Ubuntu package status: CVE-2026-109619 · Debian package status: CVE-2026-109618 · Debian package status: CVE-2026-109619.
Research demonstrations and observed attacks
PHP’s advisories describe demonstrated exploitation under specific conditions. Separately, Cloudflare’s 21 October article reports attack traffic targeting its customers and attempts to vary payloads. That is evidence of observed attack attempts; it is not a verified count of successful compromises or proof about your website.
Keep any existing defensive controls in place while applying the official fix. A firewall rule, changed upload setting or quiet log does not establish that an affected PHP runtime is safe.
Sources: Cloudflare: observed attack traffic and WAF protections · PHP: RCE via OOM corruption.
Get the official update
Use the dedicated official patch and update centre to choose the right route for Windows, Linux, source builds or managed hosting. Downloads stay with PHP and your vendor.
A safe response
- Inventory affected services and identify their authorised administrator.
- Check the actual package against both official advisories.
- Preserve evidence and involve a qualified responder if compromise is suspected.
- Verify backups, test the intended update and apply vendor-approved packages.
- Replace affected running workers, validate service and document the result.
PHP states that updating to a release containing the fixes is the complete remedy. Temporary measures have limitations. Follow the current official advice with your administrator rather than copying generic memory-limit changes.
Sources: PHP official security announcement · UK NCSC: Critical security issue affecting PHP.