Source · advisory · primary · captured

Security advisory: Critical remote code execution vulnerabilities, update now

PHP Group (php.net) · https://www.php.net/archive/2026.php#2026-10-21-5 · published 2026-10-21 · added by collector-primary · slug php-net-advisory

Official php.net advisory (archive anchor 2026-10-21-5) plus the 8.2.35/8.3.36/8.4.27/8.5.12 release posts and the 20 Oct pre-announcement on the same page. Feed <published> timestamps (00:05-00:35Z on 21 Oct; 20:32Z on 20 Oct) do not match the Foundation's stated times (release 14:00Z, pre-announcement 19:30Z). raw/ holds feed.atom and a curl copy.

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026…Unauthenticated RCE over HTTP against Apache mod_php with …Updating is the only complete mitigation; the configuratio…The flaws were disclosed on 22 October 2026The fixes were released at 14:00 UTC on 21 OctoberThe pre-announcement was published at 19:30 UTC on 20 Octo…2026-10-20 19:30 UTC: php.net publishes the pre-announceme…2026-10-21 14:00 UTC: The planned release time. php.net's …php.net

What it says, as the collector read it

php.net security advisory: notes

  • URL: https://www.php.net/archive/2026.php#2026-10-21-5 (news archive; the same page holds the four release posts and the 20 Oct pre-announcement)
  • Captured 2026-10-22T08:09Z (capture.mjs); raw/feed.atom and raw/archive-2026.curl.html fetched with curl ~08:07-08:12Z.
  • Publisher: the PHP Group / php.net. Date on the page: "21 Oct 2026".

Key wording (verbatim)

  • "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."
  • "Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."
  • "RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)"
  • "RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)"
  • "PHP 8.1 and older no longer receive updates from the PHP project." Minimal source backports were published as branches PHP-7.4/8.0/8.1-CVE-2026-109618-109619 on php/php-src.
  • remirepo: "The repo will not have updates today."
  • Mitigations: memory_limit=-1, low post_max_size (8M / 32M), session.upload_progress.enabled=0, on 8.5 fatal_error_backtraces=0. "only an update is a complete solution".
  • Pre-announcement (anchor 2026-10-20-1, "Upcoming Critical PHP Security Release"): "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC." "It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2."

Oddities

  • Atom feed timestamps: advisory 2026-10-21T00:35:26+00:00; 8.2.35 00:05:37; 8.3.36 00:14:54; 8.4.27 00:20:54; 8.5.12 00:24:52; pre-announcement 2026-10-20T20:32:00+00:00. The Foundation blog says the pre-announcement went out at 19:30 UTC and the release at 14:00 UTC on 21 Oct, and GHSAs show 13:34Z. The php.net timestamps are the entry-creation times written by the authoring script, not verified publish times; do not use them as publication times without checking the php/web-php commit history.
  • php.net's own date is 21 Oct; the BBC frames disclosure as 22 Oct (UK morning coverage). The original target date was 22 Oct 14:00 UTC (per Foundation blog).

Claims that cite it

ClaimWho says itStatusPrimarySources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35PHP Group (CNA), GitHub advisories, php.netconfirmed5/5CVE record CVE record PHP PHP php.net
Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runsPHP security team (GHSA, oss-security), php.netconfirmed3/3PHP oss-security php.net
Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safephp.net; PHP security teamconfirmed3/3php.net oss-security PHP
The flaws were disclosed on 22 October 2026
Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z.
BBC framing (UK morning coverage)contradicted2/3BBC News php.net php-src
The fixes were released at 14:00 UTC on 21 October
CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.
php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)disputed7/8oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net
The pre-announcement was published at 19:30 UTC on 20 October
The php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then.
PHP Foundationdisputed3/3PHP Foundation oss-security php.net

Events that cite it

WhenEventTime is
2026-10-20 19:30 UTCphp.net publishes the pre-announcement: release moved to 21 October 14:00 UTC, two critical vulnerabilities, CVSS v4.0 9.2, 'we reserve the right to release earlier'.disputed
2026-10-21 14:00 UTCThe planned release time. php.net's advisory 'Critical remote code execution vulnerabilities, update now' and the four release posts go up.stated

The bytes

capture 20261022T080901Z · HTTP 200 · https://www.php.net/archive/2026.php#2026-10-21-5
  • headers.json 42812c4d4f151d93b62d63d08b84b83e50a94a9e2ab79427924d5b5df582cc72 899 bytes
  • page.html 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555 99,388 bytes
  • provenance.json b1c9672106ace3646ee3912d7e4e87d94dc91cc5b60b9acc1066295675ce5014 948 bytes
  • rendered.html a8cbeb0c17b3646681217db64cce0e0beb6dc71765bd1bad550f8e20170ef7d0 238,404 bytes
  • screenshot.png 4727eaed5a4a5a90eb95aed5c3c0093702f427e1aae4bc63ed9ccfea2ca92da4 3,983,360 bytes
  • text.txt df0b1bba3deae2823b3f7c6200d5a4fafa1625c51cde86e50f650e0b0726b31e 35,947 bytes
raw, 2 files with SHA256SUMS
  • archive-2026.curl.html 3b02b9e9f8ebedb87cbe39a2852c8cc3205067f59572000c730844fbc4a03555
  • feed.atom 79c12996a433f66b2e2422e32d1dd5d4251c7c24531f75c3a0611f58dc1894a8

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →