PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
Security NEXTOct 22, 2026Translated from Japanese