PHP fixed two critical vulnerabilities on October 21, 2026.
What was fixed
The release addresses two vulnerabilities, both rated 9.2 (critical) on the CVSS v4.0 scale. CVSS (Common Vulnerability Scoring System) rates the severity of vulnerabilities from 0 to 10, and scores of 9.0 or above are critical.
| CVE | Description | CVSS v4.0 |
|---|---|---|
| CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) | RCE via out-of-memory (OOM) corruption. OOM handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. | 9.2 |
| CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) | RCE via stale global state. Request-owned internal state can survive after its memory is freed, and a later request handled by the same worker may use it. | 9.2 |
The researchers who discovered the vulnerabilities call the pair “PHP2Shell”. For their overview, see php2shell.com.
How the vulnerabilities work
Both vulnerabilities are memory-safety bugs in PHP itself, not in application code. Your app can be affected even if its own code is secure.
- CVE-2026-109618: When PHP runs out of memory, it jumps straight out of the current operation. During request startup, for example while PHP parses the request body, some request memory is reachable before it’s fully initialized. If memory runs out at that moment, PHP’s cleanup code later treats the half-initialized data as valid. The fix replaces the immediate jump with a graceful out-of-memory error at a safe point.
- CVE-2026-109619: PHP workers handle many requests in a row and keep some global state between them. If a request ends abruptly, for example with a fatal error, that state can still point to memory that’s already been freed. Some operations at the start of the next request read this stale state before PHP resets it. The fix resets all global state before those operations run.
Affected and patched versions
The following table maps each PHP branch to its patched version on Upsun Cloud:
| PHP branch | Status on Upsun Cloud | Last vulnerable version | Patched version |
|---|---|---|---|
| 8.5 | Supported | 8.5.11 | 8.5.12 |
| 8.4 | Supported | 8.4.26 | 8.4.27 |
| 8.3 | Deprecated | 8.3.35 | 8.3.36 |
| 8.2 | Deprecated | 8.2.34 | 8.2.35 |
| 8.1 | Retired | 8.1.34 | Backported fixes, image php:8.1 :1424
|
| 8.0 | Retired | 8.0.30 | Backported fixes, image php:8.0 :1628
|
| 7.4 | Retired | 7.4.33 | Backported fixes, image php:7.4 :1548
|
Check your PHP version
How you check depends on your PHP version. PHP 8.2 to 8.5: The PHP project released new version numbers, so check the PHP version:
upsun ssh --environment main --app myapp -- php -v
Replace main with your environment name and myapp with your app name. If your project has a single app, you can omit --app. The output should show the patched version from the table above, for example PHP 8.4.27.
PHP 7.4, 8.0, and 8.1: The fixes are backports without a new version number, so php -v still shows the old version. Check the image instead:
upsun app:config-get --property type --project abcdefgh1234567 --environment main
Replace abcdefgh1234567 with your project ID and main with your environment name. The output should show the patched image from the table above, for example php:8.1 :1424.
Resources:
Comments
Please sign in to leave a comment.