PHP has released emergency updates '8.5.12', '8.4.27', '8.3.36', and '8.2.35'.
PHP has released emergency updates '8.5.12', '8.4.27', '8.3.36', and '8.2.35' to address PHP2Shell.
Security advisory: Critical remote code execution vulnerabilities, update now | PHP
https://www.php.net/index.php#2026-10-21-5
Security advisory: Critical remote code execution vulnerabilities, update now | PHP: News Archive - 2026
https://www.php.net/archive/2026.php#2026-10-21-5
The PHP development team reported on October 20, 2026, that two vulnerabilities with a severity level of '9.2' had been identified. At the same time, they announced that a security patch would be released at 11:00 PM on October 21, 2026.
Two PHP vulnerabilities with a severity rating of '9.2' have been discovered, raising concerns about server hijacking. An emergency patch will be released on October 21st - GIGAZINE
Shortly before 11 PM, various websites and apps went into maintenance mode.
Various websites and apps, including Niconico and pixiv, are undergoing maintenance to support an emergency PHP patch - GIGAZINE
Then, around 11 PM, PHP versions '8.5.12,' '8.4.27,' '8.3.36,' and '8.2.35' were released. The following two vulnerabilities are fixed. Note that the PHP release notes themselves were published a little after 10:30 PM.
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) : Due to out-of-memory handling, PHP may be interrupted while internal request data is only partially initialized, and invalid data may be treated as valid data during request cleanup.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) : The internal state of a request may persist even after the backing memory has been freed. Subsequent requests processed by the same worker before a normal initialization reset may use this stale state.
The corrected version is available at the following link.
PHP: Downloads
https://www.php.net/downloads.php?source=Y
Related Posts:
in Web Service, Security, Posted by log1o_hf