PHP vulnerabilities
Two critical security vulnerabilities in PHP, fixed on 21 October 2026. Here you’ll find the assessment, the fixed versions and the sources.
According to the PHP project’s advisories, both vulnerabilities affect the 8.2, 8.3, 8.4 and 8.5 branches. The PHP project rates both as critical and names updating to a fixed version as the only complete remedy. This page deliberately describes the vulnerabilities only in general terms.
Code execution after an out-of-memory abort (OOM)
When running out of memory, PHP could leave a request in a partially initialised state that was still processed during cleanup (use-after-free). According to the advisory, remote code execution without authentication is possible.
Code execution via stale global state
In long-lived worker processes, request-specific global state was not reset before the request’s memory was freed (use-after-free). A later request to the same worker could access it.
| Branch | Fix included |
|---|---|
| PHP 8.2 | from 8.2.35 |
| PHP 8.3 | from 8.3.36 |
| PHP 8.4 | from 8.4.27 |
| PHP 8.5 | from 8.5.12 |
Comparisons are always made within the respective branch: 8.3.35 is below the fixed version, 8.4.27 reaches it. A single global minimum version would be wrong.
PHP 8.1 and older branches no longer receive updates from the PHP project. According to php.net, PHP 8.2 reaches end of support on 31 Dec 2026.
The advisories describe impacts for several server interfaces, including the Apache module, PHP-FPM, LSAPI and FrankenPHP – with attack paths confirmed to varying degrees. PHP-FPM is therefore not generally exempt. Update all PHP runtimes that run your website and restart them after the update.
Distributions may apply fixes to older package versions. Whether this applies to your package can only be proven by the respective vendor’s security advisory for exactly this package version and both CVE IDs. As long as no such evidence exists, PHP Checker classifies older base versions with a vendor revision as “Vendor check required”.
How to update PHP – step by step
Reference data: expert-reviewed on October 21, 2026 · data version 2026-10-21.1. The reference data is only updated after an actual expert review of the sources.