Global state that survives after its memory is freed can be reused across requests, leading to unauthenticated remote code execution as the web server worker.
Affected versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 |
| PHP 8.4 | < 8.4.27 | 8.4.27 |
| PHP 8.3 | < 8.3.36 | 8.3.36 |
| PHP 8.2 | < 8.2.35 | 8.2.35 |
| PHP 8.1 | all 8.1.x releases | No fix in this branch |
Older branches: affected, no fix
Exploitation conditions
- Any PHP installation serving web requests (PHP-FPM, Apache mod_php, CGI, FrankenPHP, LiteSpeed)
Remediation
Upgrade immediately to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Upstream reports no complete workaround. PHP 8.1 and older receive no upstream fix: migrate to a supported branch or obtain a vendor-supported backport.
A version number alone cannot prove patch status. Linux distributions and hosting providers often backport security fixes without changing the version. Check your vendor’s changelog.
Severity scores
| CVSS | Source | Vector |
|---|---|---|
| 9.2 v4.0 | CNA | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
References
Data provenance
Secondary sources · pending primary verificationLast reviewed: Oct 24, 2026 · Source
Notes: Upstream states PHP 5.4 through 8.5.11 are affected and that 8.1 and older receive no official fix. Some vendors distributed their own backports for older branches. CVSS vector from a single secondary source; NVD analysis pending at review time. Verify against the php-src advisory.