The hero gets the bill

Description and use

Critical PHP 8.5+ vulnerabilities allowed unauthenticated code execution. A patch was released, but delayed distribution caused temporary container exposure.

Problem

PHP 8.5+ servers were vulnerable to two critical CVEs (CVE-2026-109618 & CVE-2026-109619) that allowed unauthenticated code execution via memory‑limit exploitation, causing sites to go offline.

Outcome

After the patch, PHP sites stopped crashing due to memory_limit overflows and were protected from remote code execution. However, coordination delays caused some container images to remain vulnerable for hours.

Workflow

• Identify PHP version and memory_limit setting
• Check for CVE-2026-109618/109619 advisories
• Upgrade to patched PHP release
• Verify upgrade by testing memory_limit behavior
• Monitor site stability and logs

Evidence

Both rated 9.2 out of 10, both allowing someone with no account and no credentials to run their own code on a PHP server.

Source

The fix shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it's a big one: 300 files and nearly eleven thousand added lines

Source

The official PHP image on Docker Hub has over 1.38 billion pulls

Source