PHP released emergency updates for two high-severity vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, impacting PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Upgrades are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Which systems and versions are affected?

The issues were addressed in the new releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The issue affects PHP installations that handle web requests, including tools and configurations such as PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The biggest risk is found in the Apache mod_php setting, as it allows requests from unknown users to trigger attacks before the application code is even executed.

How problems work

The first problem is related to memory management when available space is exhausted and internal structures are half-built.…