PHP 发布紧急安全更新修复关键远程代码执行漏洞

PHP 官方发布了 8.5.12、8.4.27、8.3.36 和 8.2.35 版本，以修复两个可导致未认证远程代码执行的关键漏洞1。这两个漏洞分别编号为 CVE-2026-109618 和 CVE-2026-109619，其中前者源于内存溢出处理时的数据损坏，后者由请求后的过期全局状态引发1。

受影响范围包括 PHP-FPM、Apache mod_php、php-cgi、FrankenPHP 和 LiteSpeed1。其中 Apache mod_php 配置风险等级最高，未认证请求可在应用代码运行前触发攻击1。PHP 官方建议用户立即更新至最新版本。PHP 8.1 及更早版本已不再从 PHP 项目获得更新1。

The PHP project has released patched versions across multiple release branches to address two critical security vulnerabilities that enable unauthenticated remote code execution 1. The affected versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 1.

The first vulnerability, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), stems from data corruption during out-of-memory handling, while the second, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), involves stale global state following request processing 1. Both flaws impact all PHP Web server installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed 1. The Apache mod_php configuration presents the highest risk, as unauthenticated requests can trigger the attack before application code executes 1.

Users are advised to update immediately to the patched versions 1. PHP 8.1 and earlier versions will no longer receive updates from the PHP project 1.