Patch PHP now: Two critical remote-code bugs

What changed

If a website you run is built on PHP, put this patch at the top of your list.

PHP is an open-source programming language used to run websites and web applications. PHP’s security advisory and OpenAI’s account of the disclosure both went out on Oct 21, 2026.

Who’s at risk

PHP’s advisory says every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any of your app’s code runs.

The two bugs

• CVE-2026-109618, “RCE via OOM corruption”: if PHP runs out of memory at the wrong moment, request cleanup can treat half-set-up internal data as valid.
• CVE-2026-109619, “RCE via stale global state”: internal state from one request can outlive its memory, and a later request on the same worker can use it.

What to do

• Install the fixed release for your PHP line: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• Got PHP from a Linux distribution or an LTS vendor? PHP says they received the patches in advance, so check your vendor for updated packages.
• On an older line the PHP project no longer updates? Ask your vendor about backported fixes or move to a supported version. PHP’s advisory also links minimal source backports for people who build from source.
• Can’t update right away? The advisory lists settings that reduce exposure to specific attack paths, but says only the update is a complete fix.
• OpenAI is sharing a PHP version checker as a Codex skill to help spot potentially vulnerable versions.

How it was found

The fixes came out of a coordinated disclosure that OpenAI led through its Patch the Planet effort. PHP’s maintainers led the fixes and the release, while partners including Wiz and Cloudflare contributed research and helped prepare protections ahead of disclosure.