Two critical holes in PHP: sites rush to patch, and the foundation admits a delay

What the holes are. The first is about running out of memory. If a request hits the memory limit at the wrong moment, PHP leaves half-built internal data behind and later treats it as valid. On Apache with mod_php such a request works before the site's own code even runs. The second is in fatal error handling: a later request can use memory that belonged to an earlier one. In both cases researchers showed remote code execution.

Why it took so long. The PHP Foundation says the first signs of the memory problem showed up in 2024 during an outside audit. Back then nobody had a real attack path, and every fix had a cost: broken compatibility or changes to many third-party extensions. The security team worked by consensus and the work stalled for months. The foundation calls this a structural failure, caused by how decisions were made and too few people.

What changed. On 11 August a researcher at security firm Calif and, separately, OpenAI reported a full attack with the same root cause. Reports from Wiz and more from OpenAI followed. From then on the fix became the team's top priority.

The leak. On 20 October the flaw IDs started circulating online early, so the release moved from 22 to 21 October. The foundation says no technical details leaked then, and the real severity score is 9.2 out of 10.

The reaction. Reuters reports that government websites in Europe and elsewhere went offline. The US National Security Agency warned that such flaws often give a direct path to a server's files or database. CISA says find every system with PHP, patch internet-facing ones first, and keep PHP 8.1 and older offline until updated.

已确认的事实

• On 21 October PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical remote code execution flaws.^[1][2]
• CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution and affect all PHP installations serving web requests.^[2]
• The first flaw is memory corruption when a request hits memory_limit; on Apache with mod_php it can be triggered before any application code runs.^[1]
• The second flaw involves stale global state after a fatal error, letting a later request use freed memory.^[1]
• The first signs of the memory problem were found in 2024; the foundation called the delay a structural failure caused by its decision process and lack of resources.^[1][3]
• On 11 August 2026 a Calif researcher and, independently, OpenAI reported a full attack with the same root cause; Wiz and OpenAI sent further reports later.^[1]
• On 20 October around 15:00 UTC the flaw IDs leaked with a wrong score of 10.0; the real CVSS score is 9.2. The release moved from 22 to 21 October.^[1]
• CISA had not observed exploitation at the time of its advisory and urges immediate patching, with unpatched systems and PHP 8.1 or older taken offline.^[2]
• The US National Security Agency said such flaws often provide a direct path to a server's file system or database.^[3]
• Government websites in Europe and elsewhere went offline after the flaws were disclosed.^[3]

影响

• 已确认Any PHP site without the new version remains open to remote server takeover.
• 我们的解读More outages and temporary shutdowns are likely in the coming days at sites that have not updated.
• 我们的解读The episode will push big companies to pay more for the security of open-source code they profit from.

仍未知

• How many servers worldwide still run vulnerable versions.
• Whether confirmed attacks through these holes appear, and what damage they cause.
• When hosting providers and ready-made builds update PHP for all customers.

影响到谁

Global. Site and online shop owners, developers, anyone who keeps data or money in online services

来源

1. The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security 2026年10月21日 · 官方
2. CISA: Critical Vulnerabilities in PHP Require Immediate Patching 2026年10月21日 · 官方
3. Reuters: PHP developers issue updates to fix vulnerabilities, says flaw was found in 2024 2026年10月21日 · 媒体