Security PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 critical security updates and EOL PHP 7.4-8.1 backports

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 came out on 21 October 2026. They fix two critical vulnerabilities, both rated CVSS v4.0 9.2, that php.net gave advance notice of on 20 October. Both can allow unauthenticated remote code execution. I've backported the fixes to EOL PHP 7.2, 7.3, 7.4, 8.0 and 8.1. The updates are live for Centmin Mod 132.00stable, 140.00beta01 and 141.00beta01. 141.00beta01 is still the EL10 development branch for AlmaLinux 10 testing. If you using older Centmin Mod version, then update using instructions here.

To Update

Run cmupdate to update your Centmin Mod code before you run centmin.sh menu option 5 to rebuild PHP. I'd also reset your server's SSH passwords just to be safe.

This follows my previous update, which backported the July and September 2026 PHP security rounds to EOL PHP and patched Centmin Mod's external libgd 2.3.3 for CVE-2026-9672. If you haven't rebuilt PHP since then, this rebuild picks those fixes up too.

Security vulnerabilities fixed

Severity ratings and scores are as published on each php-src GitHub security advisory.

• CVE-2026-109618, advisory GHSA-w8hw-w9fx-j79w, Critical, 9.2, Core. RCE via OOM corruption. When a request runs out of memory, PHP can abort while request data is only partly set up, and request cleanup then treats that invalid data as valid. Backported to PHP 7.2, 7.3, 7.4, 8.0 and 8.1.
• CVE-2026-109619, advisory GHSA-6wmf-4rv5-p3rp, Critical, 9.2, Core. RCE via stale global state. Internal state from one request can outlive its freed memory, and a later request on the same worker can use it before normal startup resets it. Backported to PHP 7.2, 7.3, 7.4, 8.0 and 8.1.

One backport patch per EOL version covers both CVEs. It's the minimal mitigation the PHP security team published for PHP 7.4, 8.0 and 8.1, linked in the references below.

There's no upstream backport for PHP 7.2 and 7.3, so I ported the PHP security team's PHP 7.4 fix to them myself. It makes the same changes and has the same behaviour changes listed below.

Behaviour changes to watch for

• The advisory says the full fix in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 changes how PHP handles running out of memory. Going over memory_limit now ends the script at the next safe point. If memory use keeps climbing to a second, higher threshold, PHP exits the process straight away.
• The EOL PHP 7.2 to 8.1 patch is simpler. When a script goes over memory_limit, PHP writes the fatal error to the process's stderr and the worker exits at once. Shutdown functions don't run, and the message may not show up in your usual PHP error log. PHP-FPM starts a new child to replace the one that exited.
• The EOL PHP 7.2 to 8.1 patch also turns off session upload progress, whatever session.upload_progress.enabled is set to. If your site shows upload progress bars through PHP sessions, they'll stop updating on those versions.

PHP releases

---

• PHP 8.5.12 is the latest PHP 8.5 release. Only supported in Centmin Mod 141.00beta01.
• PHP 8.4.27 is the latest PHP 8.4 release. Only supported in Centmin Mod 141.00beta01.
• PHP 8.3.36 is the latest PHP 8.3 release. Supported in Centmin Mod 132.00stable, 140.00beta01 and 141.00beta01.
• PHP 8.2.35 is the latest PHP 8.2 release. PHP 8.2 security support ends on 31 December 2026.
• PHP 8.1.34, 8.0.30, 7.4.33, 7.3.33 and 7.2.34 are the last releases of their EOL branches. If you still run one of them, run cmupdate and re-run centmin.sh menu option 5 to recompile it with the backported security fixes.

Who is affected?

You need to act if you run any PHP version older than the patched releases.

• PHP 7.2: all 7.2.x versions are vulnerable, EOL. Patched in 7.2.34 + Centmin Mod backport.
• PHP 7.3: all 7.3.x versions are vulnerable, EOL. Patched in 7.3.33 + Centmin Mod backport.
• PHP 7.4: all 7.4.x versions are vulnerable, EOL. Patched in 7.4.33 + Centmin Mod backport.
• PHP 8.0: all 8.0.x versions are vulnerable, EOL. Patched in 8.0.30 + Centmin Mod backport.
• PHP 8.1: all 8.1.x versions are vulnerable, EOL. Patched in 8.1.34 + Centmin Mod backport.
• PHP 8.2: versions older than 8.2.35 are vulnerable. Patched in 8.2.35.
• PHP 8.3: versions older than 8.3.36 are vulnerable. Patched in 8.3.36.
• PHP 8.4: versions older than 8.4.27 are vulnerable. Patched in 8.4.27.
• PHP 8.5: versions older than 8.5.12 are vulnerable. Patched in 8.5.12.

PHP changelogs

• PHP 8.5.12 PHP: PHP 8 ChangeLog
• PHP 8.4.27 PHP: PHP 8 ChangeLog
• PHP 8.3.36 PHP: PHP 8 ChangeLog
• PHP 8.2.35 PHP: PHP 8 ChangeLog

Updating PHP on Centmin Mod LEMP stacks

• If you're on Centmin Mod 130.00beta01 or older and want PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 or 8.5 support, update your server to 132.00stable, 140.00beta01 or 141.00beta01 first outlined at https://community.centminmod.com/th...ase-with-almalinux-rocky-linux-support.25572/
• On Centmin Mod 132.00stable, 140.00beta01 or 141.00beta01, first update to the latest code with the SSH command cmupdate, which does the same as centmin.sh menu option 23 submenu option 2. Then run centmin.sh menu option 5 to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to recompile PHP 8.1.34, 8.0.30, 7.4.33, 7.3.33 or 7.2.34 with the backported security fixes.

Centmin Mod branch PHP version support

• 132.00stable: maximum PHP 8.3.36
• 140.00beta01: maximum PHP 8.3.36
• 141.00beta01: maximum PHP 8.5.12

Recommended actions

Option 1: recompile your current PHP version

This is the minimum. If your web applications need PHP 7.2, 7.3, 7.4, 8.0 or 8.1:

Code (Text):

cmupdate
centmin

Select menu option 5 and rebuild your current PHP version with the security patches applied.

Option 2: upgrade to a supported PHP version

This is the option I recommend. PHP 7.2, 7.3, 7.4, 8.0 and 8.1 are end of life and will keep collecting unpatched vulnerabilities. Upgrade to a supported version if your applications allow it.

Code (Text):

cmupdate
centmin

Select menu option 5 and choose a newer PHP version. Before upgrading, check that your web applications, such as WordPress, Xenforo or Laravel, support your target PHP version.

Security advisory references

• php.net announcement PHP: News Archive - 2026
• CVE-2026-109618 RCE via OOM corruption https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• CVE-2026-109619 RCE via stale global state https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• PHP security team backport for PHP 7.4 https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
• PHP security team backport for PHP 8.0 https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
• PHP security team backport for PHP 8.1 https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

PHP-FPM upgrade issues

If you have issues with PHP-FPM upgrades via centmin.sh menu option 5, check your PHP upgrade logs for details https://community.centminmod.com/threads/how-to-troubleshoot-php-installs-upgrades.17857/

 

Cloudflare Partial Mitigations

If your site is proxied through Cloudflare, its WAF has added managed rules for both vulnerabilities on all plans, including Free, as explained in Cloudflare deploys protections against php2shell vulnerability.

• Free plans get the rules automatically.
• Pro, Business and Enterprise plans, check that the Cloudflare Managed Ruleset is deployed in block mode. The WAF only filters traffic that passes through Cloudflare, and it's an extra layer rather than a fix, so you still need to update or recompile PHP.

If you run PHP 7.3 or older, which doesn't have a fix, keeping the site proxied through Cloudflare and only letting Cloudflare's IP ranges reach your server matters even more until you can upgrade.

 

Security Check Script

After you have updated PHP via centmin.sh menu option 5, you can use this check script to check for the fixes.

3 commands to run

Code (Text):

cd /usr/src
wget https://gist.github.com/centminmod/8fd9f0591f3c7cababc2d5a74810d68a/raw/php-eol-cve-2026-109618-check.sh
bash php-eol-cve-2026-109618-check.sh

Example outputs

For PHP 8.0.30 EOL

Code (Text):

CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 8.0.30
PHP_VERSION_ID: 80030

A. OOM bailout (shutdown fn)       PATCHED      no shutdown function, OOM msg on stderr, exit 1
B. session upload progress         PATCHED      no upload_progress_ key in $_SESSION after upload
C. Centmin patch log (info)        INFO         patch_php_211026-155226.log (last Centmin PHP 8.0 build, not necessarily this binary): Patch applied successfully for cve-2026-109618

Overall: PATCHED

For PHP 8.3.36 active fixed

Code (Text):

CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 8.3.36
PHP_VERSION_ID: 80336

version check                      PATCHED      8.3.36 >= 8.3.36

Overall: PATCHED

For PHP 8.4.27 active fixed

Code (Text):

CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 8.4.27
PHP_VERSION_ID: 80427

version check                      PATCHED      8.4.27 >= 8.4.27

Overall: PATCHED

 

Optional Paid Upgrades

Due to severity of these PHP security vulnerabilities, if you are not confident in doing the updates yourself, I am available to be hired for paid job in getting you updated for your servers. Contact me via private message if interested

Paid jobs will then be handled through my dedicated Centmin Mod's ticket support system which I use for paid work with Centmin Mod.