PHP security alert: two critical issues and the fixed versions

Security alert · 22 October 2026

On 21 October 2026, PHP released fixes for two critical security issues. Under certain conditions, an attacker could run unauthorised code on a vulnerable server without signing in.

What are the issues?

• CVE-2026-109618 — memory-handling flaw: when PHP runs out of memory, it can leave internal data in an unsafe state.
• CVE-2026-109619 — request-cleanup flaw: PHP can retain invalid internal data after a request fails and reuse it during a later request.

Which versions fix them?

Both issues are fixed in these PHP releases:

• PHP 8.5.12 for the 8.5 branch
• PHP 8.4.27 for the 8.4 branch
• PHP 8.3.36 for the 8.3 branch
• PHP 8.2.35 for the 8.2 branch

What should website owners do?

Update to the fixed release or a newer supported release, or ask your hosting provider to confirm that it has applied the security patches. Some providers backport fixes without changing the displayed version number. Updating website code or plugins alone does not patch PHP itself.

Read the official PHP security advisory.