php-8.5.12

[Joe Locash]

New point release. 2 critical CVE's have been fixed:

Message-ID: <CAEKnhAENTs9-=FsuKz8ABQ9H84jfA-xsVYT56P-OhoKnBhNN7g@mail.gmail.com>
Date: Wed, 21 Oct 2026 16:41:54 +0200
From: Jakub Zelenka <bukka@....net>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption

Hello,

The PHP security team announces a critical vulnerability in PHP core
(php-src).

CVE: CVE-2026-109618
Severity: Critical (CVSS v4.0: 9.2)

Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4
before 8.4.27, and PHP 8.5 before 8.5.12.

PHP uses longjmp() to abort request handling on out-of-memory (OOM) errors.
An allocation failure can interrupt initialization while incomplete request
state is already reachable. Request shutdown may then access this invalid
state, potentially allowing remote code execution.

Unauthenticated RCE has been demonstrated over HTTP against Apache mod_php,
before application code executes. Source analysis also indicates FPM
susceptibility, although a complete FPM exploit has not been demonstrated.

Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in the
corresponding branch. Updating is the only complete mitigation.

Full technical details and mitigation guidance are available at:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Message-ID: <CAEKnhAH+MYHvVOujPDuwwFZmLfeVySqKbmP9=7YErtqU4RB0hA@mail.gmail.com>
Date: Wed, 21 Oct 2026 16:44:06 +0200
From: Jakub Zelenka <bukka@....net>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

Hello,

The PHP security team announces a critical vulnerability in PHP core
(php-src).

CVE: CVE-2026-109619
Severity: Critical (CVSS v4.0: 9.2)

Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4
before 8.4.27, and PHP 8.5 before 8.5.12.

PHP maintains global state that temporarily points into request memory. In
some scenarios, this state is not correctly reset, or is repopulated after
being reset. Once the request memory is freed, a subsequent request handled
by the same worker may access the stale state before normal initialization
replaces it, causing a use-after-free and potentially allowing remote code
execution.

Unauthenticated RCE has been demonstrated against Apache mod_php and
PHP-FPM. Exploitability depends on the affected state, configuration, and
application behavior.

Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or a later release in the
corresponding branch. Updating is the only reliable mitigation; there is no
complete generic configuration workaround.

Full technical details and mitigation guidance are available at:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

[zeckma]

These are absolutely urgent and should also be updated on our applicable servers. This is known as PHP2SHELL.

[Bruce Dubbs]

22 Oct 2026, PHP 8.5.12

• Core:
  • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout)- (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
  • Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv)-
  • Fixed OSS-Fuzz 532353396 (assertion failure with static type).
  • Fix GH-23662 (Avoid NAN warning in print_r()).
  • Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison-
  • Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
  • Fixed AVX being reported as supported when the OS has not enabled AVX state-
  • Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
  • Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it-
  • Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping-
  • Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC-

• BCMath:
  • Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero-

• BZ2:
  • Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource-

• CLI:
  • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation)-
  • Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file)-
  • Fixed crash in the built-in server when a client is reset before being accepted-
  • Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write-

• DOM:
  • Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector-
  • Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements-
  • Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element-
  • Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element)-
  • Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object-

• FFI:
  • Fixed crashes with FFI callbacks created from call() trampolines and array callables whose object is released-

• FTP:
  • Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection)-

• GD:
  • Fixed undefined behavior with GD2 images with INT_MAX-sized chunks.
  • Fixed undefined behavior with GIFs with problematic LZW compression data.

• Intl:
  • Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern-
  • Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback-
  • Fixed Collator attribute and strength methods not rejecting an unconstructed Collator-
  • Fixed crash in intl_error_set_custom_msg() without an active call frame.
  • Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match-
  • Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks-
  • Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset-
  • Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes-

• Lexbor:
  • Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay-
  • Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the URLSearchParams tail pointer and fragment serialization without a query-

• MBString:
  • Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence)-
  • Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8-

• MySQLi:
  • Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection-

• MySQLnd:
  • Fixed field_count not resetting on OK packet.
  • Fixed memory leak when closing a prepared statement after its connection was killed-

• Opcache:
  • Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining)-
  • Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition)-
  • Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path())-
  • Fix zend_analyze_calls() call_stack buffer overrun.
  • Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance)-
  • Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property)-
  • Fix multiple incorrect DCE due to unsound escape analysis.
  • Fixed bug GH-24063 (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0-0 constant).
  • Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions-
  • Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
  • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
  • Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT)-

• OpenSSL:
  • Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout-
  • Fixed feof() on a TLS stream staying false after a close_notify on Windows.

• PCNTL:
  • Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending-
  • Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws-
  • Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork())-

• PDO:
  • Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index-
  • Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set-
  • Fixed PDOStatement::execute() leaving the previous result available after a failed execution-
  • Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's toString() during execute()-
  • Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance)-
  • Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects-
  • Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed-
  • Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value-
  • Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector-
  • Fixed PDOStatement::setFetchMode() not applying changes atomically.

• PDO_DBLIB:
  • Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction)- Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped-

• PDO_Firebird:
  • Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).

• PGSQL:
  • Fixed pg_lo_write() rejecting data containing null bytes.
  • Removed pg_service(), unavailable with any released libpq.

• Readline:
  • Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string-

• Reflection:
  • Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies invalid constant defaults with OPcache)-

• Session:
  • Fixed session_start() continuing after a failed create_sid() when session-use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)
  • Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors-

• SimpleXML:
  • Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references-

• SOAP:
  • Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key)-
  • Fixed memory leak when load_wsdl_ex() failed to load.

• SQLite:
  • Fixed a crash when SQLite3::close() is called from a userland callback.

• Standard:
  • Fixed sha1_file() returning a digest for incomplete data after a stream read failure-
  • Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler-
  • Fixed proc_open() leaking descriptor zero when descriptor setup fails.
  • Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure-
  • Fix persistent stream context lifetime during shutdown (Levi Morrison)
  • Fix wordwrap() ignoring an existing break at the end of the string
  • Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte-
  • Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer-

• Tidy:
  • Fixed a use-after-free when a tidyNode is used after its document is reparsed-

• Zlib:
  • Fixed inflate_init() dropping the preset dictionary for raw streams with a non-default window-

[Bruce Dubbs]

Updated at commits:

a51907ffa2 Update to php-8.5.12 (Security Update).
           Update to bind-9.20.30 (Security Update).
           Update to bind-utilities-9.20.30

[Bruce Dubbs]

Advisory sa-13.1-080 has been issued.