PHP project 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Patch Guide: Containing two RCE Paths in PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed

When the PHP project published 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the question for an operator is no longer whether a PHP release exists, but how quickly a web-serving estate can address two memory-handling defects that may allow unauthenticated remote code execution. The source announcement makes the exposure unusually broad: if a PHP installation serves web requests, it belongs in the review. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The mod_php path stands out because a demonstrated exploit can be reached through an unauthenticated request before any application code is run.

For a security team, the useful response is to connect three points: the affected runtime forms, the two defect mechanisms, and the support boundary around older PHP branches. This guide follows that order, then turns the facts into a checklist, misconceptions, questions and recommended actions.

Exposure map for the listed PHP serving modes

Serving mode	Source-level reason it matters	Practical review question
PHP-FPM	Named as a PHP installation that serves web requests and is therefore exposed.	Are FPM hosts running an unpatched release, and are they listed in version-control inventories?
Apache with mod_php	Called out as the highest-risk setup because a demonstrated exploit can run before application code is reached.	Which Apache instances load PHP through mod_php and can be prioritized?
php-cgi	Included among installations exposed when they serve web requests.	Are CGI entry points still present, and what PHP build do they invoke?
FrankenPHP	Included among installations exposed when they serve web requests.	Is any public or internal endpoint built on FrankenPHP?
LiteSpeed	Included among installations exposed when they serve web requests.	What PHP version is paired with LiteSpeed on each host?

The two vulnerabilities in operational terms

• Remote code execution through OOM corruption: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w). Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat that invalid data as valid.
• Remote code execution through stale global state: CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp). Internal state owned by a request can remain after the memory backing it is freed; a later request handled by the same worker may use that stale state before normal initialization resets it.

The shared theme is request-state lifecycle inside a PHP runtime. For defenders, the important takeaway is that the affected condition is tied to how a web request is initialized, handled, and cleaned up—not to any single application framework. A host that serves PHP requests should therefore be assessed by its execution mode and patch level.

Version support, backports and Linux packaging

PHP versions older than 8.1 will not receive updates from the PHP project. The announcement nevertheless notes that patches were provided for PHP 7.4, PHP 8.0 and PHP 8.1 to assist in creating backports. That distinction matters: the upstream project path and the downstream distribution path are not the same. Linux distributions and vendors received patches in advance, so updated packages should be coming soon.

Patch-readiness checklist

• Record whether each web-facing PHP service uses PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed.
• Mark mod_php hosts as priority candidates because the source ranks that setup highest due to pre-application-code exposure.
• Confirm current PHP releases and compare them against 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• For older branches, remember that versions older than 8.1 are outside project update support, while patches were provided for 7.4, 8.0 and 8.1 for backport work.
• Track Linux distribution or appliance vendor packages instead of assuming that a self-hosted build already carries the fix.
• Review change-control records for PHP version rollouts so that the status of each affected serving mode can be evidenced.

Common misconceptions

• “Only application code can be attacked.” The source specifically says a demonstrated exploit under mod_php can be triggered through an unauthenticated request before any application code is run.
• “All listed setups carry the same risk profile.” The source describes all of them as exposed when serving web requests, but singles out mod_php as the highest-risk setup.
• “Older PHP branches will still receive project updates.” The source states PHP versions older than 8.1 will not receive updates from the project.
• “Operating-system packages are already available everywhere.” The source says Linux distributions and vendors received patches in advance and that updated packages should be coming soon.

FAQ for security and platform reviewers

Is every PHP setup in the list exposed?

Every PHP installation that serves web requests is exposed, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The mod_php case is described as the highest-risk configuration because the attack can occur before application code runs.

What makes the OOM defect serious?

The defect tied to CVE-2026-109618 and GHSA-w8hw-w9fx-j79w involves out-of-memory handling interrupting PHP while internal request data is only partially initialized, followed by request cleanup that may treat invalid data as valid. The source links this behavior to remote code execution.

What does “stale global state” mean here?

In CVE-2026-109619 and GHSA-6wmf-4rv5-p3rp, internal state owned by a request can remain after the memory backing it is freed. A later request handled by the same worker may use that state before normal initialization resets it.

Can users of PHP 7.4 or PHP 8.0 simply wait for the PHP project?

No. The source says PHP versions older than 8.1 will not receive updates from the project. Patches were nevertheless provided for PHP 7.4, PHP 8.0 and PHP 8.1 to assist backporting, and updated packages are expected from Linux distributions and vendors.

Action recommendations

1. Inventory web-serving PHP by execution mode: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
2. Map each host to the released PHP versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 where the running branch supports that upgrade path.
3. Prioritize testing and rollout for mod_php instances because the source describes a demonstrated exploit reachable before application code runs.
4. For PHP 8.1, PHP 7.4 and PHP 8.0 environments, coordinate a backport plan using the patches noted by the project and the packages expected from downstream Linux suppliers.
5. For branches older than 8.1, record the absence of project updates and document the compensating timeline for vendor packages or migration to a supported branch.
6. Keep the security review focused on the two named CVEs and the two named GHSA identifiers so that triage notes, ticket records and version evidence stay traceable.

The practical boundary is clear: the PHP project has supplied the fix in 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the remaining work is organizational. Teams that can show which PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed instances are current, and which 7.4, 8.0 or 8.1 backports are waiting on Linux packaging, have a defensible response to two defects whose danger lies in reaching a web request before application code has a chance to intervene.