PHP fixes are out: 8.5.12, 8.4.27, 8.3.36 and 8.2.35

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 today, fixing two critical flaws that “can allow unauthenticated remote code execution.” PHP’s advisory says every installation serving web requests is at risk, and that “there are no complete mitigations, updating is the only safe choice.” If your company runs a PHP site, the job for today is the update, not a workaround.

This follows our report this morning on the pre-announcement. Two things are new: the fixed versions, and PHP’s own word on what the stopgaps can and cannot do.

What the two bugs do

Both are rated CVSS v4.0 9.2. The first, CVE-2026-109618, starts when PHP runs out of memory: per the advisory, handling that failure can leave request data “only partially initialized,” and cleanup then treats it as valid. The second, CVE-2026-109619, is state that outlives the request it belongs to; the GitHub advisory calls it a use-after-free that a later request in the same worker can reach.

That is why fixing the site alone is not enough. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as affected, and rates mod_php highest, “with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” Cloudflare adds that updating site code or plugins alone does not fix it.

Calif.io, Wiz, OpenAI and Quarkslab disclosed the flaws, according to Cloudflare. PHP’s advisory does not say the flaws are being exploited.

Your version number may not change

Linux distributions got the patches in advance, PHP says. That creates a trap. Ubuntu’s tracker lists the fix in php8.3 8.3.6-0ubuntu0.24.04.13 on 24.04 LTS, php8.1 8.1.2-1ubuntu2.28 on 22.04 LTS and php8.5 8.5.4-0ubuntu1.5 on 26.04 LTS. A patched 24.04 server still reports 8.3.6, not 8.3.36.

For the PHP 7 packages on Ubuntu 20.04 and 18.04, the status read “Needs evaluation” when we checked at 14:40 UTC.

For PHP 8.1 and older, the PHP project ships no release. Its security team did publish minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves.

The stopgaps, and a correction to ours

Turning off session.upload_progress.enabled blocks “the confirmed session paths but not other variants,” PHP says. It must be set in php.ini, an FPM pool or server configuration; PHP says not to rely on ini_set() or FPM .user.ini. Our earlier piece listed .user.ini as an option. For PHP-FPM, that is wrong.

For the memory bug, PHP suggests memory_limit=-1 and a low post_max_size (8M without uploads, 32M with them). Both have a cost. In our reading, no memory limit lets one request take far more memory, and PHP also suggests a container or cgroup limit as the boundary. A low post_max_size rejects larger uploads.

Cloudflare has blocked requests aimed at these flaws since 03:02 UTC today on every plan with its firewall turned on, Free included. It says this is an extra layer, not a fix.

What to do now

1. Update. Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution’s patched package, then restart PHP-FPM or Apache so old workers stop.
2. Check the package, not the banner. On Ubuntu, run dpkg -l | grep php and compare against Ubuntu’s tracker. On other distributions, check your vendor’s advisory.
3. Ask your host in writing which PHP version each site runs and when the patch went on. Cloudflare says a host that manages PHP must apply it.
4. On 8.1 or older, get a vendor backport this week and plan the move to 8.3 or newer. PHP 8.2 loses support on December 31, 2026.
5. On Cloudflare, paid plans should confirm the Managed Ruleset is set to block, Cloudflare says.

Sources

• PHP, security advisory and release notes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, October 21, 2026: https://www.php.net/archive/2026.php#2026-10-21-5
• PHP, GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• PHP, GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• Cloudflare, “Cloudflare deploys protections against php2shell vulnerability,” October 21, 2026: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
• Ubuntu, CVE-2026-109618, read October 21, 2026, 14:40 UTC: https://ubuntu.com/security/CVE-2026-109618
• Ubuntu, CVE-2026-109619: https://ubuntu.com/security/CVE-2026-109619