Today's PHP security release, and how we're strengthening security

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Today’s PHP Security Release, and How We’re Strengthening PHP Security. Published on Oct 21, 2026. The PHP Foundation News Security. Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now.

今日 PHP 安全更新及我们如何加强 PHP 安全性。发布于 2026 年 10 月 21 日。PHP 基金会新闻安全栏目。今天早些时候，PHP 项目发布了 PHP 8.5.12、8.4.27、8.3.36 和 8.2.35 版本。这些版本修复了两个关键漏洞，在特定条件下，这些漏洞允许未经身份验证的攻击者在运行 PHP 的服务器上执行代码。如果您正在运行 PHP，务必立即更新。

The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems. This post isn’t about how to update. It’s about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP’s security work going.

php.net 上的公告包含并引用了有关漏洞、攻击向量的技术细节，以及关于如何在不同系统上进行更新的说明。本文并非关于如何更新，而是关于这些漏洞是如何被发现和修复的，过去两年中 PHP 安全处理方式发生了哪些变化，以及我们需要依赖 PHP 的组织提供什么支持，以维持 PHP 的安全工作。

Two related critical remote code execution vulnerabilities. CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

两个相关的关键远程代码执行漏洞。CVE-2026-109618 / GHSA-w8hw-w9fx-j79w：通过内存溢出（OOM）损坏导致的远程代码执行（RCE）：如果请求在恰好不合适的时机达到 PHP 的内存限制（memory_limit），PHP 可能会留下部分初始化的内部数据，并随后将其视为有效数据，从而导致内存损坏。在运行 mod_php 的 Apache 上，未经身份验证的请求可以在任何应用程序代码运行之前触发此漏洞，且在默认设置下已演示了完整的远程代码执行。通过应用程序级代码路径，在 PHP-FPM 上也确认了远程代码执行。

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php. Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp：通过陈旧全局状态导致的远程代码执行：在错误的时间点发生的致命错误可能导致内部状态指向属于先前请求的内存。由同一工作进程处理的后续请求可能会使用该已释放的内存。目前已确认存在释放后使用（use-after-free）漏洞和工作进程崩溃，报告者演示了针对运行在 mod_php 的 Apache 上的真实应用程序的远程代码执行。这两个问题都位于几乎每个请求都会触及的 PHP 组件中：内存管理和错误处理。它们在 PHP 中的核心地位使得这两个漏洞既严重，又难以在不破坏兼容性、不损害性能或不强迫庞大的第三方扩展生态系统进行更改的情况下进行修复。

A first external audit and increased security focus. In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns.

首次外部审计与加强的安全关注。2024 年，PHP 进行了多年来的首次外部安全审计。PHP 基金会从 Sovereign Tech Agency 获得了资金，通过 OSTIF 组织了此次审计，并由 Quarkslab 执行。在修复 Quarkslab 报告的问题之一时，一名受雇于 PHP 基金会的 PHP 核心开发者发现了 CVE-2026-109618 背后的 OOM 问题迹象。2024 年，OOM 问题的潜在利用方式曾被理论化，但未发现具体的攻击向量，且其他具有明确影响的具体问题掩盖了这些担忧。

To fix the OOM problem, the PHP security team developed several competing approaches, but each came with its own trade-offs: backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate. The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice. Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.

为了修复 OOM 问题，PHP 安全团队开发了几种相互竞争的方案，但每种方案都有其权衡：破坏向后兼容性、产生新的拒绝服务风险，或需要更改许多难以协调的第三方扩展。PHP 安全团队在共识基础上运作，难以在这些方案中做出选择，并担心做出错误选择的后果。再加上缺乏已知的远程代码执行路径，以及具备引擎深层知识的核心开发者团队规模较小且身兼多职，这一决策过程导致修复工作在数月内反复停滞和重启。

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged.

我们不会掩饰：这种延迟是一次结构性失败，是由安全团队的决策过程及其资源匮乏共同导致的。此后，安全团队已开始改变其流程，相关工作仍在继续，以便能够通过多数票做出决策并鼓励妥协。

Building a sustainable professional security organization. Over the last months the way PHP security work is organized has changed considerably. In May 2026, the PHP Foundation created the Ecosystem Security Team, which works alongside the PHP security team on triage, coordination, and hardening. Volker Dusch’s work as AI Security Engineer in Residence at the PHP Foundation has significantly improved communication and collaboration between the PHP security team and the Foundation. Alexandre Daubois joined the PHP Foundation in July to help the PHP security team triage, handle, and fix security reports and Daniel Scherzer joined in September to take on hardening work.

建立可持续的专业安全组织。在过去的几个月里，PHP 安全工作的组织方式发生了巨大变化。2026 年 5 月，PHP 基金会成立了生态系统安全团队，与 PHP 安全团队共同负责分类、协调和加固工作。Volker Dusch 作为 PHP 基金会的驻场 AI 安全工程师，显著改善了 PHP 安全团队与基金会之间的沟通与协作。Alexandre Daubois 于 7 月加入 PHP 基金会，协助 PHP 安全团队对安全报告进行分类、处理和修复；Daniel Scherzer 于 9 月加入，负责加固工作。

Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic’s Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI’s Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports. The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024.

今年早些时候，我们与 Alpha-Omega 合作，使用 Anthropic 的 Claude Mythos 对 PHP 进行了扫描。但在 Mythos 扫描之后，我们增加了其他工具，包括用于验证报告和漏洞利用的 OpenAI Daybreak Red，以及与 PHP 支持的所有平台上的 CI 相匹配的清理构建（sanitizer builds）和复现环境。PHP 基金会将 PHP 项目纳入了 Patch the Planet 计划，作为该计划的一部分，安全公司 Calif 于 2026 年 7 月 30 日开始对 PHP 进行审计。8 月 11 日，Calif 的研究员 Ryan A 报告了一个无条件远程代码执行漏洞，其根本原因与我们在 2024 年发现的 OOM 问题相同。

OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation’s team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties. The growth of AI-assisted research also means the PHP security team receives far more reports than before. As Alexandre Daubois described last week in How the PHP Security Team Handles Your Reports, the team has published 15 CVEs since July 1st and worked…

OpenAI 在同一天独立报告了相同的根本原因，随后 OpenAI 在 9 月 18 日、Wiz 在 8 月 24 日又报告了进一步的攻击向量。最近，Trail of Bits 也一直在对 PHP 进行审计。来自 Calif、OpenAI 和 Wiz 的报告明确了 OOM 问题的全部影响，从 8 月 11 日起，修复该问题成为 PHP 基金会所有安全团队的首要任务。如果没有基金会的资助，就不可能有多人全职投入此问题，最终通过周末和全天候的工作来协调并与相关各方进行沟通。AI 辅助研究的增长也意味着 PHP 安全团队收到的报告比以往多得多。正如 Alexandre Daubois 上周在《PHP 安全团队如何处理您的报告》中所述，该团队自 7 月 1 日以来已发布了 15 个 CVE，并致力于……