PHP patches two critical flaws in memory and request cleanup
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities in memory-error handling and stale request state. Under exploitable conditions, unauthenticated requests can lead to remote code execution. The PHP team identifies all web-serving installations as at risk, with the highest risk in Apache’s mod_php configuration. Its advisory says configuration workarounds reduce specific attack paths but do not replace an update.
The PHP Foundation · Oct 21, 2026
Why it matters
These failures occur in runtime cleanup and initialization, so application authentication alone does not establish protection.
More context
Use the official advisory to match the deployed PHP branch with its fixed release or distribution backport. It covers PHP-FPM, mod_php and other web-serving configurations. The Foundation’s account also explains how compatibility concerns, staffing and consensus delayed the fixes, and describes changes to security coordination.
Keep in mind
Exploitability varies by deployment and code path; a crash is not automatically remote execution. Older branches require vendor backports or migration to a supported release, and mitigations are incomplete.
Original read