No results found.

The 21st October 2026 PHP updates fix CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state). Fixed upstream releases: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

This local check exercises PHP’s OOM termination behaviour with an 8 MiB memory limit. Patched implementations stop before the test shutdown handler runs. No HTTP requests, configuration changes or root access are needed.

Older PHP versions

  • Sury: updated PHP 7.4 and PHP 8.1 packages are available. Check the installed package changelog for both CVEs; the upstream version number alone does not identify a backport.
  • Ubuntu: PHP 7.4 on Ubuntu 20.04 is fixed through Ubuntu Pro ESM; PHP 8.1 on Ubuntu 22.04 has a standard security update. See Ubuntu’s package status.
  • Ubuntu Pro offers a free personal subscription for up to five machines. Subscribe · Eligibility and terms.

Standalone script

Save the following as check-php-security-fixes.sh. It needs Bash and a PHP CLI binary. This copy is complete and can be used independently of the GitHub repository.

#!/usr/bin/env bash

# Checks the OOM behaviour changed by the PHP security fixes released on
# 21st October 2026. This runs in a short-lived CLI process and uses about 10 MB.

php_bin=${1:-php}

if ! command -v "$php_bin" >/dev/null 2>&1; then
    echo "PHP binary not found: $php_bin" >&2
    exit 2
fi

version=$($php_bin -n -r 'echo PHP_VERSION;' 2>/dev/null)

# An unpatched PHP runs this shutdown function after hitting its memory limit.
# Patched releases terminate safely before it can run.
# shellcheck disable=SC2016
test_code='register_shutdown_function(function () { fwrite(STDERR, "SHUTDOWN-RAN\n"); }); $objects = array(); while (true) { $objects[] = new stdClass(); }'

output=$(
    "$php_bin" -n \
        -d memory_limit=8M \
        -d memory_hard_limit_percent=110 \
        -d display_errors=1 \
        -d log_errors=0 \
        -r "$test_code" 2>&1
)
status=$?

echo "PHP $version ($php_bin)"

if [[ $output == *"SHUTDOWN-RAN"* ]]; then
    echo "NOT PATCHED: PHP ran the shutdown handler after running out of memory."
    exit 1
fi

if [[ $status -eq 137 && $output == *"Hard memory limit"* ]]; then
    echo "PATCHED: PHP used the new hard memory limit and stopped safely."
    exit 0
fi

if [[ $status -eq 1 && $output == *"Allowed memory size"* ]]; then
    echo "PATCHED: PHP used the safe OOM exit from the 7.4-8.1 backport."
    exit 0
fi

echo "INCONCLUSIVE: PHP exited with status $status and returned:"
echo "$output"
exit 2

Run the saved copy:

bash check-php-security-fixes.sh
bash check-php-security-fixes.sh /usr/bin/php8.1

Results

Exit codeMeaning
0Patched behaviour observed
1Old bailout behaviour observed
2PHP was not found or the result was inconclusive

Docker

Run inside each PHP container:

docker exec -i CONTAINER bash -s < check-php-security-fixes.sh

Scope

Checks the tested CLI binary with php.ini and optional extensions disabled. It does not independently verify every fix for both CVEs or inspect running FPM/Apache workers. Apply the complete vendor update and restart or replace all workers.

Runtime-tested against PHP 8.5.11 and 8.5.12; older backport behaviour verified from source only.

References

On this page