Security advisory: Critical remote code execution vulnerabilities, update now
- ID
- 38014
- Status
- summarized
- Published
- 21 Oct 2026, 4:15 AM
- Fetched
- 22 Oct 2026, 3:09 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.php.net/archive/2026.php
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.5
- Created
- 22 Oct 2026, 3:10 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
The PHP project issued an urgent advisory for two critical unauthenticated RCE bugs fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: CVE-2026-109618 (out-of-memory handling leaves request data partially initialized, then cleanup treats it as valid) and CVE-2026-109619 (request-owned state survives after its memory is freed and is reused by a later request on the same worker). Risk is highest for Apache mod_php, where a demonstrated exploit fires before any application code runs; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also listed as at risk. PHP 8.1 and older get no project updates, the volunteer rpms.remirepo.net repo will not have updates on release day, and the team shipped only minimal source backports for 7.4/8.0/8.1. Interim mitigations (not fixes) are memory_limit=-1 enforced via php_admin_value so apps can't override it, plus post_max_size=8M, or 32M if uploads are needed.
Why it matters
If you run WordPress, Laravel, or any PHP app — including on Malaysian shared hosting or cPanel boxes where you don't control the patch schedule — the decision this week is whether you're on 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or on a vendor backport, and you should confirm that with your host rather than assume. Anyone still pulling PHP from rpms.remirepo.net has no update path today and should switch to distro packages or build from source. If you genuinely can't patch immediately, the only levers given are memory_limit=-1 set at FPM/Apache level and a low post_max_size — and the advisory is explicit that these reduce specific attack paths but do not make an install safe.
Discussion angle
Patch lag on managed and shared hosting: how do you actually verify your host is on 8.4.27 or a backport instead of trusting a status page — and is it worth pinning your own PHP build for client sites you can't control?