PHP 8.2.35: Patch the Critical RCE Bugs Before They Spread

An application can look healthy while the runtime underneath is one patch behind. On October 21, 2026, the PHP project released PHP 8.2.35 as a security update, not a feature release. It fixes two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), meaning someone who has not logged in may be able to make the server run attacker-chosen instructions. For a public website, that turns a small version gap into an incident-response problem. (php.net)

What PHP 8.2.35 changes

The final number in 8.2.35 is the patch level. Releases like this are meant to correct defects while keeping the behavior of the 8.2 branch as stable as possible, so the important change is not new syntax or a new framework feature. The important change is what happens inside PHP when it handles request memory, errors, and long-running worker processes.

Every PHP 8.2 build older than 8.2.35 is affected by the two vulnerabilities described in the release advisory. A CVE, or Common Vulnerabilities and Exposures identifier, gives each security issue a stable name that administrators can search for in vulnerability scanners and security reports.

The two bugs live below application code

CVE-2026-109618: when out-of-memory handling goes wrong

Out of memory, often shortened to OOM, means a process cannot obtain another block of memory. PHP normally has to stop the current operation and clean up the request. The flaw fixed in PHP 8.2.35 could interrupt that process while internal request data was only partly initialized, then allow shutdown code to treat the incomplete data as valid.

Think of an HTTP request as a temporary workbench. PHP places input, upload information, error state, and other pieces on that workbench while the request runs. If the workbench is dismantled halfway through setup, cleanup must know which pieces exist. Under the vulnerable path, a carefully formed request could turn a memory failure into memory corruption and, ultimately, code execution. Multipart requests, the format commonly used for file uploads, are particularly relevant to this class of failure. (github.com)

CVE-2026-109619: stale state carried into a later request

The second issue involves stale global state. A PHP worker is a process that handles one request after another, especially in setups such as PHP-FPM, the PHP FastCGI Process Manager. Some internal state can live longer than a single request, but it must not keep pointing to memory that PHP has already released.

A use-after-free happens when software continues using memory after that memory has been returned to the allocator. In this case, one request could leave behind a reference to request-owned data. A later request handled by the same worker could encounter that reference before normal initialization replaced it. That makes worker reuse part of the story: the dangerous state can cross the boundary between two otherwise unrelated HTTP requests.

Who needs to update?

The PHP security advisory covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The demonstrated risk is highest for some mod_php configurations, but that is not a reason to treat other deployments as safe. One of the serious details is that an attack may reach the PHP engine before application code, authentication checks, or framework middleware gets a chance to help.

A command-line-only installation has a different exposure profile, yet it still deserves an update if it processes untrusted files, handles uploads in scheduled jobs, or runs long-lived workers. Shared hosting and container environments need attention too; the PHP version inside the service is what matters, not only the version installed on an administrator's workstation.

A practical update plan

Treat the update as a production repair rather than a routine version comparison.

1. Identify the runtime that serves requests. Start with the command-line binary:

php -v
php --ini

That output does not always describe the PHP instance used by the web server. Check the PHP-FPM service, container image, Apache modules, or hosting control panel as well.

2. Install PHP 8.2.35 through your normal trusted channel. On a Debian or Ubuntu system, the shape of the command may look like this, although package names and repositories vary:

sudo apt update
sudo apt install --only-upgrade php8.2 php8.2-fpm
sudo systemctl restart php8.2-fpm

Do not assume that the newest package in every repository is already 8.2.35. Confirm the installed version after the update. For containers, rebuild from an official image pinned to php:8.2.35-fpm, then roll out the new image and recreate every container. (hub.docker.com)

3. Restart every PHP worker. Restart PHP-FPM pools, Apache processes using mod_php, or the equivalent service in your environment. A binary update does not protect requests still being handled by old workers. In a clustered deployment, complete the rollout across all nodes rather than updating only the machine receiving a small sample of traffic.

4. Verify the serving path. Check both the command-line version and the service or image inventory:

php -v
systemctl status php8.2-fpm --no-pager

A temporary internal health check can confirm the version used for HTTP requests, but avoid leaving a public phpinfo page exposed.

5. Consider whether the server was exposed while unpatched. If an internet-facing host ran an older PHP 8.2 build, review web and system logs for unusual upload traffic, unexpected files, unfamiliar child processes, or unexplained outbound connections. Updating contains the vulnerable code; it does not prove that a previously exposed server was untouched.

Can a php.ini change make this safe?

No—not completely. The PHP team describes updating to a fixed release as the only complete mitigation. Configuration changes involving memory limits, upload sizes, or session upload handling can reduce specific attack paths, but they do not cover every way the underlying state-management bugs may be reached. They can also create availability problems or break legitimate uploads if applied without testing. (php.net)

That distinction matters during an incident. A smaller upload limit is a useful defensive boundary, but it is not a substitute for PHP 8.2.35. Patch first, restart workers, and then review hardening settings as a separate task.

PHP 8.2.35 is a bridge, not a destination

PHP 8.2 reaches end of life on December 31, 2026. The supported-versions policy lists security support through that date, while PHP 8.3 is supported through December 31, 2027, PHP 8.4 through December 31, 2028, and PHP 8.5 through December 31, 2029.

That gives PHP 8.2 users two jobs. Apply 8.2.35 immediately, then begin a branch upgrade in staging. Test Composer dependencies, extensions, php.ini settings, background workers, and the web server integration before moving production. The patch closes today's critical hole; the migration plan prevents the next unsupported-version emergency.

PHP 8.2.35 is easy to overlook because the version string changes by only one number. The consequences are much larger. Update the runtime, restart every worker, verify the version serving real traffic, and treat December 31, 2026 as a firm deadline rather than a distant calendar note.