Релизы безопасности PHP устраняют две критические уязвимости RCE

октябрь 21, 2026 • 09:57 • 5 минут чтения • 0 просмотров • 0 комментариев

The PHP team just released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution. The team is asking everyone to update immediately, and it says there are no complete mitigations.

Every PHP install that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. That covers the way most Laravel apps run in production, so plan to update your servers today.

Note: This is a breaking story and we will be updating this as new information comes out.

#The Vulnerabilities

The PHP team rates the risk highest for mod_php, where it has a working exploit that triggers from an unauthenticated request before any application code runs. Here are the two CVEs:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup can then treat that invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): internal state owned by a request can survive after its memory is freed. A later request on the same worker can use that stale state before normal initialization resets it.

#How to Update

Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Source downloads are on the PHP downloads page, and Windows builds are there too.
Linux distributions and LTS vendors got the patches in advance, so check your vendor for updated packages.
PHP 8.1 and older no longer get updates from the PHP project. Some distributions and LTS vendors backport fixes, so check with yours or upgrade to a supported version.
If you use the volunteer-maintained rpms.remirepo.net repo, it won't have updates today. The PHP team recommends switching to distribution packages or building from source.

Because of the severity, the PHP security team also published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1 for anyone building from source without an LTS vendor.

#Laravel Cloud, Forge, Vapor, and Envoyer

Laravel is posting status for each of its platforms in PHP critical vulnerability response updates. As of its 23:26 UTC update on October 21:

#Laravel Cloud

Laravel has patched every running application on Cloud in place with the PHP and Node.js security releases. Apps now run PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the version they use. No redeploy is needed, deployments have resumed, and new deployments use the updated base images.

#Laravel Forge

Forge servers need a manual update:

On PHP 8.2, 8.3, 8.4, or 8.5, open each server in Forge and click Update PHP. Laravel says updates can take longer than usual because of demand.
If that fails, update PHP over SSH with the Forge guide. Run php -v on the server to confirm it is patched.
Servers on Ubuntu 20.04 or older can't get the update. Create a new server on a supported Ubuntu version and move your sites to it. Laravel recommends powering down the old server until you do.
Forge has no patch for PHP 8.0 or 8.1. Upgrade to PHP 8.2 or later.
Forge does not update Node.js for you, so update it on each server that runs it.

#Laravel Vapor

The patched PHP runtimes are live on Vapor, but you will need to deploy your apps yourself:

Apps on a native runtime with PHP 8.2 or later need a redeploy.
Apps on a custom or Docker image runtime need a new deployment, not only a redeploy.
Vapor has no patch for PHP 8.0 or 8.1. Upgrade to PHP 8.2 or later.

#Laravel Envoyer

Envoyer is back online and deployments are running. Health checks are not restored yet. Laravel says that needs a further PHP update, which it will handle separately.

#If You Can't Update Right Away

Updating is the only complete fix. The advisory lists settings that reduce exposure to specific attack paths, but the PHP team is clear that they don't make an install safe.

For CVE-2026-109618 (OOM corruption):

Set memory_limit=-1 somewhere apps can't override it, such as php_admin_value in the FPM pool or Apache config. Check that no pool, directory, or app setting puts a finite limit back.
Lower post_max_size. The advisory suggests 8M for apps without file uploads and 32M for apps that need them. Keep upload_max_filesize below post_max_size.
Enforce request limits at the web server or proxy for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits also need to cover requests without a usable Content-Length.
Use a container or cgroup memory limit, ideally one that kills only the affected worker. Don't use RLIMIT_AS or RLIMIT_DATA instead, because they can cause the vulnerable allocation failure.

For CVE-2026-109619 (stale global state):

Set session.upload_progress.enabled=0 in php.ini, an FPM pool, or server config, then restart every worker. ini_set() and FPM .user.ini files don't apply early enough.
On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
Remove invalid or deprecated per-request settings that emit diagnostics before initialization. Hiding them with error_reporting, display_errors, or @ doesn't help.
Fix fatal errors and execution timeouts an attacker can reach, including failures in callbacks, upload or import processing, and cleanup.

#If you are an older version of Laravel

For over a decade, Laravel Shift has been a trusted service in the Laravel community. It's the fastest and most thorough way to upgrade your Laravel application.