Today's PHP security release, and how we're strengthening security

What it is

The PHP Foundation's account of the 21 October 2026 security release (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). It fixes two critical flaws that, under the right conditions, let an unauthenticated attacker run code on a PHP server. Both sit in memory management and error handling, which nearly every request touches. Only one CVE is named: CVE-2026-109618, the out-of-memory (OOM) problem. The post says the technical details, attack vectors and update instructions are in the php.net announcement, and it does not repeat them.

Preconditions / Affected

• The post says the severity is conditional ("under the right conditions"), but does not state the conditions.
• The leaked CVSS score of 10.0 was wrong. The actual score is 9.2.
• The OOM root cause was first spotted in 2024 during the Quarkslab audit. No concrete exploit path was known until Calif (Ryan A) reported unconditional remote code execution on 11 August 2026. OpenAI reported the same root cause the same day. Wiz added attack vectors on 24 August and OpenAI on 18 September.

What to do

Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. Distributions and LTS vendors received the patch in advance, so check your distributor's packages. Read the php.net announcement for the mitigation and attack-vector details.

Exposure window

The embargo broke before the release, which affects how urgent patching is.

• 20 October, about 15:00 UTC: the two CVE IDs spread on forums and social media, with a wrong release time and the wrong score.
• 20 October, 19:30 UTC: PHP published the pre-announcement early. Around 20:00 UTC, Calif mistakenly published a proof-of-concept video, which was deleted but copied. The post says it sped up PoC development.
• 20 October, about 23:00 UTC: mitigation advice given to a few critical infrastructure providers may also have leaked.
• 21 October, 07:41 UTC: Chainguard published fixed images over six hours before the release, so attackers could study the fix in binary form.
• 21 October, 14:00 UTC: release, moved forward from 22 October.

Caveats

• The PHP team monitored the PoCs and found no functional exploit at the time of release. The post gives no later status, so assume that has changed.
• The security team admits the fix stalled for months because the competing fixes each had trade-offs (compatibility breaks, new denial-of-service potential, or changes to many third-party extensions). It calls this a structural failure.
• The team has published 15 CVEs since 1 July 2026 and rejected over 100 reports as invalid, duplicate or not reproducible. It expects report volume to keep growing.
• The post ends with a funding appeal for the PHP Foundation.