PHP 8.4.27 and 8.5.12 Fix Two Critical RCE Flaws

PHP 8.4 and 8.5 installations need the security releases #

The PHP 8.4.27 announcement and the PHP 8.5.12 announcement both describe a security release that fixes CVE-2026-109618 and CVE-2026-109619. Both state that all users of their branch are strongly encouraged to update immediately. Upgrade to 8.4.27 or 8.5.12 is the action the sources give for these branches, and each release's changes are recorded in the ChangeLog linked from its announcement.

The sources say there are no complete mitigations for these two CVEs. The 8.5.12 announcement states:

There are no complete mitigations, updating is the only safe choice. PHP 8.5.12 Released!

The 8.4.27 announcement contains the same sentence. For operators, this means a configuration change cannot replace the upgrade for these two CVEs, so the plan for 8.4 and 8.5 servers should be an upgrade rather than a workaround.

PHP 8.6.0 pre-release builds: RC4 carries the fixes and is for testing #

The PHP 8.6.0 RC4 announcement states that this version contains the fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. It also says that "Everyone running earlier builds of PHP 8.6.0 is strongly encouraged to update immediately." The announcement calls RC4 the third release candidate of PHP 8.6.0.

The same announcement limits its use: do not use RC4 in production, because it is an early test version. The next release, RC5, is planned for 5 November 2026 and will be the last release candidate. Testers should report issues through the GitHub Issues linked from the announcement.

Session upload progress: the interim setting for CVE-2026-115560 #

The session upload progress advisory of 23 October 2026 states: "We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release." The same setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619, published on 21 October 2026. If that mitigation is already in place, the advisory says to keep it and take no further action.

The advisory says the issue "can only occur under an unusual combination of configuration and application code." The application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(), while session upload progress is still enabled. Applications that never change the handler at runtime can keep the feature enabled. This suggests that applications with the runtime switch should apply the interim value now, since the full advisory for CVE-2026-115560 comes with the next release.

Checking PHP sessions for the serialize handler switch #

Start by reading the values that the PHP CLI reports for the two settings. The command below prints both, though it reflects only the CLI configuration and not the values set during a web request.

php -r 'var_dump(ini_get("session.upload_progress.enabled"), ini_get("session.serialize_handler"));'

Because the risky switch happens in application code, search the codebase for the handler. This suggests that a runtime ini_set() call for the handler is what to look for. Run the search from your application's source directory, since the path varies by project layout.

grep -rn "serialize_handler" .

Protection steps for PHP security releases and session settings #

The steps follow the guidance in the sources. Upgrade first, because the sources state there are no complete mitigations for the two critical CVEs, and then apply the session setting only where the configuration and code pattern match.

1. Upgrade PHP 8.4 installations to 8.4.27 and PHP 8.5 installations to 8.5.12.
2. Move PHP 8.6.0 pre-release builds to RC4 for testing only, and keep RC4 out of production.
3. If the application configures php_binary or php_serialize and then switches to php at runtime with ini_set() before session_start(), set session.upload_progress.enabled=0 until the next regular bugfix release.
4. If the mitigation from GHSA-6wmf-4rv5-p3rp is already applied, keep it in place, as the advisory instructs.
5. Watch for the full advisory for CVE-2026-115560 with the next release. RC5 is planned for 5 November 2026.

Affected and fixed PHP versions #

The fixed versions above are the ones the sources name. The security advisory page for these CVEs was not among the supplied sources, so this article does not list affected earlier builds or affected version ranges for any branch, including CVE-2026-115560.