On Tuesday 21 October 2026 the PHP project released four security versions at once: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities in the core of the language, identified as CVE-2026-109618 and CVE-2026-109619 and known together as php2shell. This article explains what they are, with the official sources, and the status of Almendro services: all of them have been running the fixed version since that same day.
What the PHP project says
The official announcement of version 8.5.12 is blunt. Quoting it: "This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice." The wording is identical in the announcements for 8.4.27, 8.3.36 and 8.2.35.
The project's two security advisories, published on GitHub the same 21 October, detail each flaw. Both score 9.2 out of 10 on CVSS 4.0, critical severity:
- CVE-2026-109618, "RCE via OOM corruption": PHP exited a request that ran out of memory leaving half built data behind, which it later treated as valid. The advisory confirms the impact as "unauthenticated remote code execution as the web worker account".
- CVE-2026-109619, "RCE via stale global state": some input, configuration, session and error handling operations ran before the next request was initialized and could touch memory from a request already freed. The confirmed impact is "unauthenticated heap use-after-free, memory disclosure and remote code execution".
All versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected. Versions 8.1 and earlier no longer receive fixes from the PHP project, so there is no patch for them: anyone still on them has to upgrade.
Why it matters
PHP powers a huge share of the web, including WordPress, WooCommerce and most invoicing and commerce systems in Costa Rica. A flaw that allows running code without credentials, as the web server account, is the most serious thing that can happen to an application exposed to the internet: whoever exploits it can read data, change it or take the service down. And because the problem is in PHP itself, updating the application, the theme or the plugins does nothing: only updating PHP does.
The status of Almendro services
On the same 21 October, as soon as the fixed versions were published, we updated our whole platform to PHP 8.5.12: the fe.almendro.cr platform, the almendro.cr website, the point of sale, the online stores we operate for our clients and the staging environments. That is eleven applications, and all eleven were on the fixed version before the day was over. While we prepared the update we also applied the partial mitigation recommended by the community, and removed it once each service was patched, because the new version makes it unnecessary.
Every update followed the same care as always: a database backup first, each application's automated test suite executed on the new PHP version before touching production, and verification of each service afterwards. In our review of the fe.almendro.cr logs we found no sign that the flaws had been exploited before the patch.
Your data and your vouchers require no action on your part.
If you run PHP on a server of your own
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch, and restart PHP. It is the only complete fix.
- If you run an unsupported version, 8.1 or earlier, there is no patch for you: plan an upgrade to a supported version. Keep in mind that PHP 8.2 stops receiving security fixes on 31 December 2026.
- If you use shared hosting, confirm with your provider that the update has been applied; most of them announced it the same day.
Sources
- Official PHP 8.5.12 announcement, PHP project, 21 October 2026.
- PHP 8.5.12 change log, PHP project.
- Security advisory GHSA-w8hw-w9fx-j79w, CVE-2026-109618, PHP project on GitHub.
- Security advisory GHSA-6wmf-4rv5-p3rp, CVE-2026-109619, PHP project on GitHub.
- Supported PHP versions, PHP project.
