## Security advisory: Critical remote code execution vulnerabilities, update now

- 種別: release
- 重大度: critical
- 関連技術: php
- CVE: CVE-2026-109618
- 公開日時: 2026-10-21T00:35:26.000Z
- 情報源: PHP News (https://www.php.net/index.php#2026-10-21-5)
- パーマリンク: https://vulnpulse.app/items/php-news-180b24ab7a3e

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs. Who is at risk: The vulnerabilities: , CVE-2026-109618 (): out-of-memory handling can interrupt PHP while internal request data is onl…