PHP security updates fix two critical flaws; later notice narrows a session risk

PHP released security updates on October 21 for two critical flaws in its core engine that can permit remote code execution without authentication. The PHP security team urges operators of web-serving installations to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. That includes sites using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; the team rates demonstrated exposure highest for mod_php.

An additional PHP notice on October 23 identifies an unusual session configuration that can leave a separate code-execution path. It recommends disabling session upload progress until a later regular bug-fix release for affected applications. It does not withdraw the October 21 updates or describe a new general exposure for every PHP installation.

The big change

• What changed: PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619 in four supported release lines. The fixes address errors in how the engine handles interrupted requests and request-owned memory.
• Why it matters: The vulnerable code sits in PHP itself. Depending on the server interface and configuration, a web request can reach it before the site's application code runs. Updating the application's own code alone does not install the PHP engine fix.
• What to check: Identify the PHP version actually serving requests and obtain the patched build from PHP or the relevant operating-system or long-term-support vendor. Separately check whether the precise session-handler sequence in PHP's October 23 notice applies.

Two flaws, one urgent update

PHP's October 21 advisory names two different failures. CVE-2026-109618 concerns out-of-memory handling: PHP can interrupt a request while internal request data is partly initialized, after which cleanup may treat that data as valid. CVE-2026-109619 concerns stale global state: information owned by one request can remain after its memory is freed and be used by a later request handled by the same worker. PHP says both can allow unauthenticated remote code execution. Its advisory describes a demonstrated path against Apache mod_php before application code executes; it does not say that every PHP application or server configuration has an identical exploit path.

The four PHP project releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive ordinary project updates. PHP says some Linux distributions and long-term-support vendors have backported fixes, and it supplied minimal source backports for 7.4, 8.0 and 8.1. Operators on vendor-maintained builds need to check that vendor's patched package rather than assume that an upstream version string alone settles its status. PHP says exposure-reduction settings are incomplete substitutes for updating.

The October 23 notice is narrower. PHP says the remaining session upload progress vector requires an application configured with session.serialize_handler as php_binary or php_serialize, followed by an in-application switch to php before session_start(), while session upload progress remains enabled. Applications that never change the handler at runtime can keep the feature enabled, PHP says. For the unusual affected configuration, PHP suggests session.upload_progress.enabled=0 until the next regular bug-fix release. It plans a full advisory for CVE-2026-115560 with that release. The same setting was already listed as a mitigation for one of the October 21 flaws; the new notice clarifies a remaining path and does not make the setting a complete replacement for the October 21 patches.

What AI contributed to the discovery

The disclosure also offers a specific account of AI-assisted security research, with humans and PHP maintainers still central to the work. OpenAI says Calif identified one critical flaw using GPT-5.6 Sol in its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. Calif's own account describes researchers examining older PHP memory-limit behavior with an LLM's help and developing demonstrations. Wiz says its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during discovery, exploit development, detection and patch validation. These are participants' accounts of their research, not evidence that a model autonomously found, fixed or deployed the patches. PHP's maintainers led the fixes and release, according to OpenAI.

The useful distinction for site operators is between the research story and the remedy. The researcher demonstrations show why the engine-level findings matter; PHP's own advisory establishes the supported patch versions and the scope of its follow-up notice. Neither research team's examples establish that a particular installation has been compromised. The immediate decision is to verify the deployed PHP build, apply the relevant patched package, and check the specific session configuration if it is in use.

Sources & further reading

• PHP security advisory and October 23 session notice: The maintainer's patch versions, affected server interfaces, mitigation limits and narrowly defined follow-up configuration.
• PHP 8.5.12 release announcement: Confirms the 8.5 security release and the absence of a complete mitigation short of updating.
• PHP's two detailed advisories and stale-global-state advisory: Maintainer descriptions of the distinct flaws and version ranges.
• Calif Research's disclosure, OpenAI's coordination account and Wiz Research's report: Firsthand accounts of research and AI assistance; each party describes its own role.