The PHP Foundation recently released security updates for PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical remote code execution (RCE) vulnerabilities. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allowed unauthenticated attackers to execute code on servers under specific conditions. The first vulnerability involved out-of-memory (OOM) corruption, where PHP could leave partially initialized internal data behind during a memory limit hit, leading to memory corruption. The second involved a 'use-after-free' error where a fatal error could leave internal state pointing to memory from a previous request, allowing a subsequent request to access that freed memory. Both issues were particularly severe because they resided in core components—memory management and error handling—that nearly every request touches.
The PHP Foundation acknowledged that the delay in fixing these issues was a 'structural failure' caused by a lack of resources and a consensus-based decision-making process. In 2024, during the project's first external security audit in years, the team identified the OOM problem but struggled to choose a fix because every available option involved significant trade-offs, such as breaking backward compatibility, introducing new denial-of-service risks, or requiring massive changes to third-party extensions. To address these systemic issues, the Foundation has restructured its security operations, creating an Ecosystem Security Team and hiring dedicated staff to handle triage and hardening. They have also integrated AI-assisted research tools from providers like Anthropic and OpenAI to help validate reports and group vulnerabilities sharing the same root cause.
The PHP Foundation is restructuring its security operations to address systemic vulnerabilities and improve response times.
Despite these internal improvements, the release process faced significant external complications due to a leak of the coordinated disclosure. Two days before the scheduled release, the CVE IDs began circulating on social media with incorrect CVSS scores. This leak led to a premature public announcement and a one-day acceleration of the release date to ensure users could update as quickly as possible. Furthermore, the Foundation noted that some entities broke the disclosure embargo prematurely; for instance, one security firm mistakenly published a proof-of-concept video, and a distributor published built images containing the fix before the official release. These incidents underscored the difficulty of managing coordinated disclosures in a high-stakes environment where attackers can study binary fixes as soon as they are available to distributors.