PHP vulnerabilities - upgrade to 8.5.12 immediately

[Phroobar]

Just relaying information from the PHP site. https://www.php.net/

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.


We've upgraded our instance to PHP 8.5. We have no idea how Mantis will be affected. It seems okay for now.

[atrol]

We've upgraded our instance to PHP 8.5. We have no idea how Mantis will be affected. It seems okay for now.

That should work if you are running MantisB 2.28.4.
Currently there is just one known minor PHP 8.5. related issue that will be fixed in next version 2.29.0, see https://mantisbt.org/bugs/view.php?id=37366