PHP releases fixes for two critical remote code execution flaws rated 9.2
In short
The PHP development project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on CVSS v4.0. The PHP team says they can lead to remote code execution without authentication and urges all users to update immediately. Several Japanese game and web services announced emergency maintenance around the release time.
Read the full story 2 min read
The PHP development project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, according to Gigazine and ITmedia. Mynavi News reported that the security team published the release on 21 October for flaws, CVE-2026-109618 and CVE-2026-109619, that could lead to remote code execution without authentication. ITmedia said the official site strongly recommends that all PHP users update immediately. [ 9 , 10 , 11 ]
According to Mynavi News, the PHP team said all PHP environments that handle web requests are affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It said mod_php carries the highest risk because a working exploit has been demonstrated there. CVE-2026-109618 stems from out-of-memory handling and CVE-2026-109619 from state left over after a request. The team said there is no full mitigation and updating is the only way to be safe. It also published minimal backported fixes for PHP 7.4, 8.0 and 8.1, which are no longer officially supported. The listed interim measures only reduce exposure to particular attack paths, it said, and PHP 8.2 reaches end of support on 31 December 2026. [ 10 ]
The security team had announced on 20 October that the update would be published at 23:00 Japan time on 21 October. The two flaws are each rated 9.2 on CVSS v4.0, the Critical band. The team said details and affected versions would be disclosed at release, and that it might publish earlier if details leaked or exploitation was found. CERT-EU issued an alert on 20 October saying all versions from PHP 5 onward may be affected, and advised organisations to identify PHP applications and prepare to patch. If that is not possible, it suggested disconnecting internet-facing applications from external networks. [ 1 , 2 , 4 , 7 ]
Gigazine reported that researcher Kirill Firsov posted a video on X, under the name php2shell, showing attacks that ran commands on test environments using WordPress, Drupal and Magento. The security company watchTowr said it reproduced an attack for CVE-2026-109618 and withheld technical details, and that it had confirmed no real-world exploitation. ITmedia reported that GMO Flatt Security presumed a memory corruption bug, and, if the flaw matches the firm's own research, one tied to the Session Upload Progress feature. [ 3 , 4 , 5 ]
Game*Spark and INSIDE reported that the IPA, which has urged system operators to prepare to apply the fix, said it has not confirmed attacks and that its alert is precautionary. Maintenance was announced for Cygames titles including Uma Musume and Granblue Fantasy, and for Shadowverse: Worlds Beyond, Dorufin Webu (ドルフィンウェーブ), CHUNITHM-NET and Hebun Banzu Reddo (ヘブンバーンズレッド). OBS Studio said parts of its website would be unavailable. The Shadowverse: Worlds Beyond team said it has confirmed no damage or user data leak. [ 7 , 8 ]
Why it matters
Japanese tech outlets note that PHP runs a large number of websites and services, so a flaw in PHP itself can affect many of them. The PHP team says updating is the only way to secure systems, and ITmedia and Game*Spark report that companies and service operators were preparing or carrying out maintenance around the release.
Key facts
- The PHP security team announced on 20 October that it would publish a security update at 23:00 Japan time on 21 October for two critical vulnerabilities. [ 1 , 2 , 4 , 7 ]
- Both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 (Critical) on CVSS v4.0. [ 2 , 4 , 7 , 10 ]
- The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [ 9 , 11 ]
- The PHP team says the flaws can lead to remote code execution without authentication and that no full mitigation exists besides updating. [ 10 ]
- CERT-EU said all PHP versions from PHP 5 onward may be affected. [ 2 , 4 ]
- The PHP team also published minimal backported fixes for PHP 7.4, 8.0 and 8.1, which are no longer officially supported. [ 10 ]
- Cygames titles including Uma Musume and Granblue Fantasy, and other services, announced emergency maintenance around 23:00 on 21 October. [ 7 , 8 ]
Confirmed by several sources
- Two critical PHP vulnerabilities rated 9.2 on CVSS v4.0 were announced on 20 October, with fixes scheduled for 23:00 Japan time on 21 October. [ 1 , 2 , 4 , 7 ]
- The PHP project released fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [ 9 , 11 ]
- The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. [ 2 , 4 , 10 ]
- CERT-EU warned that all PHP versions from PHP 5 onward may be affected and recommended preparing to apply the fix at once. [ 2 , 4 ]
Still unclear
- Which PHP versions are affected overall. CERT-EU and some researchers say PHP 5 onward may be affected, while the PHP team's own statement as reported by Mynavi News names affected environments and offers backports for 7.4, 8.0 and 8.1.
- Whether the flaws are being exploited in real attacks. watchTowr said it has confirmed no such cases and the IPA is not aware of attacks, but researcher Kirill Firsov has posted a video of attacks on test environments.
- The technical cause as estimated by GMO Flatt Security, namely a memory corruption bug tied to the Session Upload Progress feature. ITmedia's summary says this holds only if the flaw matches the company's own research, and only the summary is available.
- The IPA said it has not confirmed attacks exploiting the vulnerabilities and called its alert precautionary. Reported only in the Game*Spark and INSIDE articles, which carry the same text.
What local media are saying
Timeline, local time
- ASCII.jp reports the PHP team's 20 October notice that fixes will be released at 23:00 Japan time on 21 October. [ 1 ]
- Gigazine reports researcher Kirill Firsov's attack video and watchTowr's reproduction of CVE-2026-109618. [ 4 ]
- Maintenance on Hebun Banzu Reddo (ヘブンバーンズレッド) begins for security measures. [ 7 ]
- Scheduled release time for the PHP fix and the start of emergency maintenance for Uma Musume, Granblue Fantasy and others. [ 2 , 7 ]
- Gigazine reports the release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. [ 9 ]
- Mynavi News reports that the security release was published on 21 October with an urgent call to update. [ 10 ]
- ITmedia reports the fixed versions and the project's call for immediate updates. [ 11 ]