# PHP security updates fix two critical flaws; later notice narrows a session risk

> PHP has patched two critical engine flaws across four supported release lines. An October 23 notice separately describes an unusual session configuration that needs a temporary safeguard.

By BIGCHANGE.AI Editorial

Published: 2026-10-23T19:42:38.831Z
Updated: 2026-10-23T19:42:38.831Z
Canonical: https://bigchange.ai/blog/php-security-updates-session-risk-october-2026

![Conceptual charcoal illustration of an open server rack with a wired service terminal on a supported pull-out shelf.](https://bigchange.ai/api/media/file/php-server-maintenance-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

PHP released security updates on October 21 for two critical flaws in its core engine that can permit remote code execution without authentication. The PHP security team urges operators of web-serving installations to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. That includes sites using PHP-FPM, Apache mod\_php, php-cgi, FrankenPHP and LiteSpeed; the team rates demonstrated exposure highest for mod\_php.

An [additional PHP notice on October 23](https://www.php.net/archive/2026.php#2026-10-23-1) identifies an unusual session configuration that can leave a separate code-execution path. It recommends disabling session upload progress until a later regular bug-fix release for affected applications. It does not withdraw the October 21 updates or describe a new general exposure for every PHP installation.

## The big change

- **What changed:** PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619 in four supported release lines. The fixes address errors in how the engine handles interrupted requests and request-owned memory.
- **Why it matters:** The vulnerable code sits in PHP itself. Depending on the server interface and configuration, a web request can reach it before the site's application code runs. Updating the application's own code alone does not install the PHP engine fix.
- **What to check:** Identify the PHP version actually serving requests and obtain the patched build from PHP or the relevant operating-system or long-term-support vendor. Separately check whether the precise session-handler sequence in PHP's October 23 notice applies.

## Two flaws, one urgent update

[PHP's October 21 advisory](https://www.php.net/archive/2026.php#2026-10-21-5) names two different failures. CVE-2026-109618 concerns out-of-memory handling: PHP can interrupt a request while internal request data is partly initialized, after which cleanup may treat that data as valid. CVE-2026-109619 concerns stale global state: information owned by one request can remain after its memory is freed and be used by a later request handled by the same worker. PHP says both can allow unauthenticated remote code execution. Its advisory describes a demonstrated path against Apache mod\_php before application code executes; it does not say that every PHP application or server configuration has an identical exploit path.

The four PHP project releases are **8.5.12, 8.4.27, 8.3.36 and 8.2.35**. PHP 8.1 and older no longer receive ordinary project updates. PHP says some Linux distributions and long-term-support vendors have backported fixes, and it supplied minimal source backports for 7.4, 8.0 and 8.1. Operators on vendor-maintained builds need to check that vendor's patched package rather than assume that an upstream version string alone settles its status. PHP says exposure-reduction settings are incomplete substitutes for updating.

The October 23 notice is narrower. PHP says the remaining session upload progress vector requires an application configured with `session.serialize_handler` as `php_binary` or `php_serialize`, followed by an in-application switch to `php` before `session_start()`, while session upload progress remains enabled. Applications that never change the handler at runtime can keep the feature enabled, PHP says. For the unusual affected configuration, PHP suggests `session.upload_progress.enabled=0` until the next regular bug-fix release. It plans a full advisory for **CVE-2026-115560** with that release. The same setting was already listed as a mitigation for one of the October 21 flaws; the new notice clarifies a remaining path and does not make the setting a complete replacement for the October 21 patches.

## What AI contributed to the discovery

The disclosure also offers a specific account of AI-assisted security research, with humans and PHP maintainers still central to the work. [OpenAI says](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) Calif identified one critical flaw using GPT-5.6 Sol in its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. [Calif's own account](https://calif.io/php2shell/) describes researchers examining older PHP memory-limit behavior with an LLM's help and developing demonstrations. [Wiz says](https://www.wiz.io/blog/php2shell-php-rce) its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during discovery, exploit development, detection and patch validation. These are participants' accounts of their research, not evidence that a model autonomously found, fixed or deployed the patches. PHP's maintainers led the fixes and release, according to OpenAI.

The useful distinction for site operators is between the research story and the remedy. The researcher demonstrations show why the engine-level findings matter; PHP's own advisory establishes the supported patch versions and the scope of its follow-up notice. Neither research team's examples establish that a particular installation has been compromised. The immediate decision is to verify the deployed PHP build, apply the relevant patched package, and check the specific session configuration if it is in use.

## Sources & further reading

- [PHP security advisory and October 23 session notice](https://www.php.net/archive/2026.php): The maintainer's patch versions, affected server interfaces, mitigation limits and narrowly defined follow-up configuration.
- [PHP 8.5.12 release announcement](https://news-web.php.net/php.announce/513): Confirms the 8.5 security release and the absence of a complete mitigation short of updating.
- [PHP's two detailed advisories](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [stale-global-state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp): Maintainer descriptions of the distinct flaws and version ranges.
- [Calif Research's disclosure](https://calif.io/php2shell/), [OpenAI's coordination account](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) and [Wiz Research's report](https://www.wiz.io/blog/php2shell-php-rce): Firsthand accounts of research and AI assistance; each party describes its own role.

## Sources

- [PHP 2026 news archive: October 21 security advisory and October 23 session notice](https://www.php.net/archive/2026.php) — Authoritative release versions, security scope and exact later configuration.
- [PHP 8.5.12 release announcement](https://news-web.php.net/php.announce/513) — Confirms the security release and patch priority.
- [PHP: RCE via OOM corruption](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) — Maintainer description of CVE-2026-109618.
- [PHP: RCE via stale global state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) — Maintainer description of CVE-2026-109619.
- [Calif Research PHP2Shell disclosure](https://calif.io/php2shell/) — Research participant account of LLM-assisted investigation.
- [OpenAI Patch the Planet coordination account](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) — Participant account of Calif, Wiz and maintainer roles.
- [Wiz Research PHP2Shell report](https://www.wiz.io/blog/php2shell-php-rce) — Participant account of independent research and model use; broad prevalence rhetoric omitted.