PHP 8.5.12 Fixes Two Out-of-Memory RCE Bugs; 8.1 and Older Get No Official Patch
Software / news
PHP 8.5.12 Fixes Two Out-of-Memory RCE Bugs; 8.1 and Older Get No Official Patch
The advisory names mod_php as the worst case, because the attack lands before any application code runs, and lists four ini settings for sites that cannot patch today.
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to close two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. The PHP project's own advisory says it "strongly urges" every user to update. Branches 8.1 and older get no release at all.
The bugs were found by Wiz Research, whose PHP2Shell write-up was published the same day. Wiz rates the worst of them CVSS 9.2 and says every PHP release of the last decade is affected by at least one flaw, going back to PHP 5.4.
What the two CVEs actually are
Both bugs live in how the engine handles a request that dies partway through. The advisory describes CVE-2026-109618 as remote code execution through out-of-memory corruption: when PHP runs out of memory it can be interrupted while internal request data is only partly initialised, and cleanup then treats that invalid data as valid.
CVE-2026-109619 is the second half. Request-owned internal state can outlive the memory behind it, and a later request on the same worker may use that stale state before normal initialisation resets it. That second detail is why a single bad request can poison the next one.
Wiz wrote that the flaws stem from how PHP handles fatal errors, especially out-of-memory errors. Our earlier coverage of the pre-announcement could not name the versions. The advisory now does.
Fixed versions and who gets nothing
| Branch | Fixed in | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Supported until Dec. 31, 2026 |
| 8.1 and older | None | Minimal source backports only |
For 7.4, 8.0 and 8.1 the PHP security team published minimal source backports, aimed at people who build from source or have no long-term-support vendor. Distribution vendors may ship their own backports, and the advisory tells everyone else to move to a supported branch.
PHP 8.2 has about ten weeks of support left. A site that patches to 8.2.35 today is still on a branch that stops getting fixes on Dec. 31.
Why mod_php is the worst case
The advisory covers every way of serving PHP over the web: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
That matters for what Wiz demonstrated. The company ran unauthenticated RCE against the latest container images of WordPress, Drupal and Joomla using a combined script it calls php2shell. It also showed remote memory disclosure without code execution, which Wiz says can expose passwords, tokens and API keys. Wiz did not claim it has seen exploitation in the wild.
If you cannot patch today
The advisory lists mitigations and says plainly that they reduce exposure without making an installation safe. The settings are specific about where they must be applied:
- Set
memory_limit=-1throughphp_admin_valuein FPM or Apache config so applications cannot override it. The advisory says not to useRLIMIT_ASorRLIMIT_DATA. - Set
post_max_sizeto 8M, or 32M if uploads are needed, and keepupload_max_filesizebelow it. - Set
session.upload_progress.enabled=0inphp.inior server config and restart every worker.ini_set()and.user.inido not count. - On PHP 8.5 only, set
fatal_error_backtraces=0and restart workers.
The restart instruction is the one most likely to be skipped. A worker that has not been recycled keeps running with the old settings.
The timeline
Wiz said it found the first bug on Aug. 19 and confirmed unauthenticated RCE against Drupal the next day and WordPress on Aug. 21. It reported to the PHP security team on Aug. 24. PHP acknowledged on Sept. 21 and the patches landed on Oct. 21, 30 days after the acknowledgement and 58 days after the first report. Our coverage of curl's CVE-2026-92392 deals with another memory-lifetime bug in widely deployed C code.
Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and credits the models with discovery, exploit development and patch validation. The advisory itself says nothing about how the bugs were found.
The next date to watch is Dec. 31, when 8.2 loses support. Wiz wrote that other variants likely exist and that the patched releases remove all of them.
Sources
More in Software
- 01NetWasm's C# Hello World Is 47,895 Bytes, 10.7% Under Rust's Size-Tuned Build, by Its Author's Own CountThe comparison pits a default C# release publish against a Rust build with five hand-set size flags, and the repo's own methodology page says it is not a language ranking.
- 02Anthropic Says Claude Found 4,500 Lines of Pre-Auth OpenSSH Code; OpenSSH's Notes Describe It as Off by DefaultChris Rohlf's attack-surface study reports 493 issues across 25 projects and says nothing about false positives or how many were fixed. Its OpenSSH case study and OpenSSH's own release notes need reading side by side.
- 03Rust's Two Biggest Compiler Projects Carry No Dates; the Measured Speed-Up Came From LLVM 23A compiler contributor's October 19 roundup and the Rust project's own goal pages agree on the list. They disagree on how much of it is measured.
- 04Mastodon 5.0 Moves the Composer to Bottom-Centre and Puts Stable Release 'a Few Weeks' OutThe project's October 19 design post lists what changed since the August preview and what was cut. Search, Settings, Messages and Notifications are still on the old interface.