# Critical PHP vulnerabilities allow unauthenticated remote code execution

> **Key takeaway:** Two critical vulnerabilities in PHP allow unauthenticated attackers to execute remote code, necessitating immediate updates to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.

**Published:** 2026-10-22T13:26:51+00:00 
**Source:** Bruce Schneier Security Affairs 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/critical-php-vulnerabilities-allow-unauthenticated-remote-co.html 

## Summary
PHP maintainers have patched two critical vulnerabilities that enable unauthenticated remote code execution (RCE). The flaws affect various deployment methods including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Users are urged to update their installations immediately to mitigate the risk.

## Technical details of the PHP RCE vulnerabilities
- **CVE-2026-109618**: An out-of-memory (OOM) handling error can interrupt PHP while internal request data is only partially initialized, causing request cleanup to treat invalid data as valid.
- **CVE-2026-109619**: A stale global state vulnerability where request-owned internal state survives after its backing memory is freed, allowing a subsequent request on the same worker to use that state.
- The risk is highest for **mod_php** installations, where exploits can be triggered before any application code executes.

## Why it matters
Since PHP powers a vast portion of the web, these RCE vulnerabilities pose a significant threat to web servers and cloud-native applications using PHP-based stacks.