# PHP Critical Security Vulnerabilities: Patch 8.2 to 8.5

URL: https://3ammarketer.com/news/php-critical-security-vulnerability
Published: 2026-10-29

> PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 patch two 9.2 CVSS remote code execution flaws affecting millions of web servers.

These flaws impact all PHP environments processing web requests, dating back to PHP version 5 in July 2004. [1][2][4]

Palo Alto Networks identified more than 22.6 million publicly exposed instances that may be vulnerable to the flaws across web hosting environments. [3]

## The October 2026 critical vulnerability landscape

The two vulnerabilities are designated CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 out of 10 under the Common Vulnerability Scoring System. CVE-2026-109618 involves out-of-memory handling that interrupts PHP while internal request data is only partially initialized, leading to out-of-memory corruption. CVE-2026-109619 involves stale global state where request-owned internal state survives after its backing memory has been freed. The PHP Foundation published an initial advisory on October 20 without version details, before the official release on October 21. [1][2]

Wiz researchers dubbed their proof of concept 'php2shell' and noted that an unauthenticated attacker could execute code on vulnerable servers or read process memory. That exposed memory may contain authentication tokens, passwords, API keys, and certificates. Dave Ottenheimer noted that an attacker might only need to upload a specially crafted file through a vulnerable upload form. [1][2]

## Immediate configuration mitigations for high-risk setups

The PHP Foundation and security advisories emphasize that there are no complete mitigations other than updating the runtime software. Official WordPress guidance confirms that no separate WordPress update is required or planned, and WordPress administrators can check their active PHP version by navigating to Tools, opening Site Health, and expanding the Server section under the Info tab. Temporary mitigations should not replace official security updates, and the UK National Cyber Security Centre advises organizations to consider taking exposed systems offline if security fixes cannot be applied quickly. [1][2][4]

![A table showing the specific patched PHP versions for each active branch.](https://dygolixznokmekyvajbb.supabase.co/storage/v1/object/public/images/content/f1b8c14204f70ed1af8bbbed.png)

If immediate binary upgrades are not possible, administrators should disable session upload progress by setting session.upload_progress.enabled=0, set memory_limit=-1 preferably via php_admin_value so applications cannot override it, and restrict post_max_size to 8M (or 32M if file uploads are necessary). [1]

## Deployment risks across server architectures

All PHP environments serving web requests face exposure, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. However, the highest risk configuration is mod_php, where a demonstrated exploit allows an unauthenticated request to trigger code execution before any application code runs. [1]

## Planning for the PHP 8.2 end-of-life deadline

Official support and binary patches for these vulnerabilities are only provided for PHP 8.2 and newer releases. However, PHP 8.2 will reach end of life on December 31, 2026, receiving zero security updates past that date. While the PHP security team published minimal source-backports for PHP 7.4, 8.0, and 8.1 to assist source builds, legacy versions receive no official package maintenance. [1][2][4]

Our read: Do not rely on configuration stopgaps when facing unauthenticated RCE on internet-facing web servers. If you cannot immediately patch to the supported security releases, take the server offline rather than trusting partial php.ini directives. Prioritize instances running mod_php, where exploits trigger before application code executes.

Limit: The provided sources do not confirm how many of the 22.6 million exposed instances are actively compromised or how many run mod_php versus PHP-FPM.

## Sources

1. [PHP: News Archive - 2026](https://www.php.net/archive/2026.php#2026-10-21-5)
2. [PHP Issues Emergency Fixes for Critical Server Vulnerabilities | Межа](https://mezha.net/eng/news/185ddfad_php_issues_emergency_fixes/)
3. [Critical PHP flaws put millions of websites at risk as exploit attempts emerge | IBM](https://www.ibm.com/think/news/critical-php-flaws-millions-websites-risk-exploit-attempts-emerge)
4. [Critical PHP Security Update in October 2026: What WordPress Website Owners Need to Do | CNX Web Design](https://cnxwebdesign.com/critical-php-security-update-in-october-2026-what-wordpress-website-owners-need-to-do/)