---
type: "post"
id: "the-php-project-released-security-updates-on-21-3da3dc"
slug: "the-php-project-released-security-updates-on-21-3da3dc"
title: "The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit"
description: "The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit unauthenticated remote code execution in web-serving PHP installations."
retrieval_nugget: "The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit unauthenticated remote code execution in web-serving PHP installations."
published_at: "2026-10-21"
updated_at: "2026-10-21"
record_date: "2026-10-21"
date_kind: "published_at"
topics: ["agent-security","sandbox"]
entities: ["PHP","PHP-FPM","Apache HTTP Server","FrankenPHP","LiteSpeed"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "PHP disclosed two critical unauthenticated remote-code-execution vulnerabilities and urged users to update; none of the prior documents cover this incident."
prior_refs: []
source_url: "https://www.php.net/index.php"
source_urls: ["https://www.php.net/index.php"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:the-php-project-released-security-updates-on-21-3da3dc"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/the-php-project-released-security-updates-on-21-3da3dc/","markdown":"https://newruntime.com/posts/the-php-project-released-security-updates-on-21-3da3dc.md","json":"https://newruntime.com/posts/the-php-project-released-security-updates-on-21-3da3dc.json"}
---

# The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit

## Retrieval answer

The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit unauthenticated remote code execution in web-serving PHP installations.

The PHP project released security updates on 21 October 2026 for two critical vulnerabilities that can permit unauthenticated remote code execution in web-serving PHP installations. The issues are CVE-2026-109618 and CVE-2026-109619.

Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP says installations handling web requests are in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It identifies mod_php as the highest-risk configuration and says it has demonstrated an exploit path that can run before application code executes.

One flaw concerns out-of-memory handling while internal request data is partially initialized; the other concerns request-owned state surviving after its backing memory is freed and being reused by a later worker request. PHP says only updating is a complete solution. It lists configuration measures that may reduce specific attack paths but explicitly says they do not make an installation safe.

PHP 8.1 and older are no longer supported by the project, though some distribution and LTS vendors may provide backports. The source does not provide a CVSS score, affected-installation count, or evidence of exploitation outside the demonstrated mod_php attack path.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)