New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released fixes for two critical vulnerabilities, including RCE via OOM corruption and RCE via stale global state. All PHP users are encouraged to update immediately.
Intelligence analysis by Qwen 2.5 (3B)
PHP maintainers have released security updates for two critical vulnerabilities, urging all users to update to regain security.
Two big problems were found in PHP. One is like when you try to eat a big cookie but your hands are still wet from washing them. The other is like when you leave a toy in a box, and later someone else uses it without knowing it's not theirs. PHP fixes these problems to keep your data safe.
Analysis
PHP Vulnerability Details
RCE via OOM Corruption (CVE-2026-109618)
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been updated to address a critical vulnerability where out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid, leading to remote code execution (RCE).
RCE via Stale Global State (CVE-2026-109619)
Another critical vulnerability, RCE via stale global state, has also been patched. This issue arises when request-owned internal state can survive after its backing memory has been freed. A later request may use that stale state before normal initialization resets it, allowing for remote code execution (RCE).
Key points
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been updated to address two critical vulnerabilities.
- The vulnerabilities allow for remote code execution, which can be used by attackers to take control of your computer.
- All PHP users are encouraged to update immediately to protect against these vulnerabilities.
The updates will make PHP safer, but there are still other problems that need to be fixed. The updates will help protect against bad guys who try to break into your computer.
Even with the updates, there are still other vulnerabilities that could be found. The updates alone won't make PHP completely safe.
