PHP Releases Critical Fixes, Acknowledges Delay After 2024 Warning

PHP has released fixes for two critical vulnerabilities that can let unauthenticated attackers execute code on affected servers. Alongside the updates, the PHP Foundation acknowledged that work on one underlying problem stalled after its first warning signs were found in 2024.

The foundation called the delay a “structural failure,” pointing to difficult compatibility choices, a consensus-based decision process and too few developers with deep knowledge of the engine.

What was known in 2024

A core developer found signs of the out-of-memory problem while addressing findings from a 2024 external audit. At that stage, an exploit was theorized but no concrete attack path had been established, according to the foundation. Competing fixes carried risks including compatibility breaks and changes across third-party extensions.

The foundation says the picture changed on August 11, 2026, when Calif and OpenAI independently reported remote-code-execution findings with the same root cause. Additional attack paths followed. That distinction matters: early knowledge of a design weakness is not the same as evidence that attackers had been exploiting it since 2024.

Four supported branches receive fixes

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale internal state across requests.

The PHP project urges all users to update immediately. It identifies web-serving installations across PHP-FPM, Apache with mod_php and other environments as at risk, with the highest risk assessed for mod_php. Hosting customers should check their provider’s patched packages; older installations may need a vendor backport or an upgrade to a supported branch.

A process problem as well as a software problem

The foundation says it is changing decision-making so difficult fixes can progress through majority decisions and compromises, with earlier escalation to leadership. It has also expanded security coordination and hardening work.

Its account highlights a limit of faster vulnerability discovery: finding bugs does not remove the need for experienced engineers to assess trade-offs, review patches and coordinate releases. The foundation is asking organizations that depend on PHP to fund that work.

Sources

• Reuters: patches and the delayed warning
• PHP project: critical security advisory and fixed versions
• PHP Foundation: discovery timeline and security-process changes