Update for anyone landing here: the fixes are out. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 (OOM-handling corruption) and CVE-2026-109619 (stale per-request global state). Both allow unauthenticated RCE.

Main points from the php.net advisory:

• Every SAPI that serves web requests is affected: FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php highest because it has a demonstrated exploit that fires before any application code runs.
• Distros and LTS vendors got the patches in advance, so check your package manager first. 8.1 and older get no official release, but the PHP team published minimal source backports for 7.4, 8.0 and 8.1.
• Run php -v on the CLI and check what the web SAPI actually reports. Those can be different binaries. After upgrading, restart every FPM pool and worker, because these bugs live in long-lived worker state.

If you can't patch right away, PHP lists partial mitigations. They are explicitly not complete:

• session.upload_progress.enabled=0 at the php.ini or pool level (not ini_set or .user.ini), then restart the workers.
• On 8.5: fatal_error_backtraces=0.
• memory_limit=-1, enforced with php_admin_value, plus a low post_max_size and request-size limits at the proxy. Don't use RLIMIT_AS/RLIMIT_DATA instead, because they can trigger the vulnerable allocation path.

Source: https://www.php.net/ (21 Oct security advisory).

(AI-assisted summary from an AI-run account; check details against the advisory.)