USN-8948-1: PHP vulnerabilities

Q: Does exploitation require local access to the affected system?

No. Both issues are described as remotely exploitable and could allow a remote attacker to execute arbitrary code.

Q: Which Ubuntu PHP package deployments should be reviewed?

The listed packages are libapache2-mod-php8.5, php8.5-cgi, php8.5-cli, php8.5-fpm, libapache2-mod-php8.3, and php8.3-cgi.

Q: What package version is referenced for the PHP 8.5 Ubuntu source package?

The advisory references php8.5 source package version 8.5.9-0ubuntu2.1.

Published Oct 21, 2026

Updated

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

Affected Software

33 affected componentsFixes available

PHP PHP

All of the following

ubuntu/libapache2-mod-php8.5<8.5.9-0ubuntu2.1

8.5.9-0ubuntu2.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/php8.5-cgi<8.5.9-0ubuntu2.1

8.5.9-0ubuntu2.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/php8.5-cli<8.5.9-0ubuntu2.1

8.5.9-0ubuntu2.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/php8.5-fpm<8.5.9-0ubuntu2.1

8.5.9-0ubuntu2.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/libapache2-mod-php8.5<8.5.4-0ubuntu1.5

8.5.4-0ubuntu1.5

Ubuntu Ubuntu=26.04

All of the following

ubuntu/php8.5-cgi<8.5.4-0ubuntu1.5

8.5.4-0ubuntu1.5

Ubuntu Ubuntu=26.04

All of the following

ubuntu/php8.5-cli<8.5.4-0ubuntu1.5

8.5.4-0ubuntu1.5

Ubuntu Ubuntu=26.04

All of the following

ubuntu/php8.5-fpm<8.5.4-0ubuntu1.5

8.5.4-0ubuntu1.5

Ubuntu Ubuntu=26.04

All of the following

ubuntu/libapache2-mod-php8.3<8.3.6-0ubuntu0.24.04.13

8.3.6-0ubuntu0.24.04.13

Ubuntu Ubuntu=24.04

All of the following

ubuntu/php8.3-cgi<8.3.6-0ubuntu0.24.04.13

8.3.6-0ubuntu0.24.04.13

Ubuntu Ubuntu=24.04

All of the following

ubuntu/php8.3-cli<8.3.6-0ubuntu0.24.04.13

8.3.6-0ubuntu0.24.04.13

Ubuntu Ubuntu=24.04

All of the following

ubuntu/php8.3-fpm<8.3.6-0ubuntu0.24.04.13

8.3.6-0ubuntu0.24.04.13

Ubuntu Ubuntu=24.04

All of the following

ubuntu/libapache2-mod-php8.1<8.1.2-1ubuntu2.28

8.1.2-1ubuntu2.28

Ubuntu Ubuntu=22.04

All of the following

ubuntu/php8.1-cgi<8.1.2-1ubuntu2.28

8.1.2-1ubuntu2.28

Ubuntu Ubuntu=22.04

All of the following

ubuntu/php8.1-cli<8.1.2-1ubuntu2.28

8.1.2-1ubuntu2.28

Ubuntu Ubuntu=22.04

All of the following

ubuntu/php8.1-fpm<8.1.2-1ubuntu2.28

8.1.2-1ubuntu2.28

Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libapache2-mod-php8.5 to a version that resolves this vulnerability.
Fixed in 8.5.9-0ubuntu2.1
Upgrade
Upgrade ubuntu/php8.5-cgi to a version that resolves this vulnerability.
Fixed in 8.5.9-0ubuntu2.1
Upgrade
Upgrade ubuntu/php8.5-cli to a version that resolves this vulnerability.
Fixed in 8.5.9-0ubuntu2.1
Upgrade
Upgrade ubuntu/php8.5-fpm to a version that resolves this vulnerability.
Fixed in 8.5.9-0ubuntu2.1
Upgrade
Upgrade ubuntu/libapache2-mod-php8.5 to a version that resolves this vulnerability.
Fixed in 8.5.4-0ubuntu1.5
Upgrade
Upgrade ubuntu/php8.5-cgi to a version that resolves this vulnerability.
Fixed in 8.5.4-0ubuntu1.5
Upgrade
Upgrade ubuntu/php8.5-cli to a version that resolves this vulnerability.
Fixed in 8.5.4-0ubuntu1.5
Upgrade
Upgrade ubuntu/php8.5-fpm to a version that resolves this vulnerability.
Fixed in 8.5.4-0ubuntu1.5
Upgrade
Upgrade ubuntu/libapache2-mod-php8.3 to a version that resolves this vulnerability.
Fixed in 8.3.6-0ubuntu0.24.04.13
Upgrade
Upgrade ubuntu/php8.3-cgi to a version that resolves this vulnerability.
Fixed in 8.3.6-0ubuntu0.24.04.13
Upgrade
Upgrade ubuntu/php8.3-cli to a version that resolves this vulnerability.
Fixed in 8.3.6-0ubuntu0.24.04.13
Upgrade
Upgrade ubuntu/php8.3-fpm to a version that resolves this vulnerability.
Fixed in 8.3.6-0ubuntu0.24.04.13
Upgrade
Upgrade ubuntu/libapache2-mod-php8.1 to a version that resolves this vulnerability.
Fixed in 8.1.2-1ubuntu2.28
Upgrade
Upgrade ubuntu/php8.1-cgi to a version that resolves this vulnerability.
Fixed in 8.1.2-1ubuntu2.28
Upgrade
Upgrade ubuntu/php8.1-cli to a version that resolves this vulnerability.
Fixed in 8.1.2-1ubuntu2.28
Upgrade
Upgrade ubuntu/php8.1-fpm to a version that resolves this vulnerability.
Fixed in 8.1.2-1ubuntu2.28

Event History

Oct 21, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Does exploitation require local access to the affected system?

No. Both issues are described as remotely exploitable and could allow a remote attacker to execute arbitrary code.

Which Ubuntu PHP package deployments should be reviewed?

The listed packages are libapache2-mod-php8.5, php8.5-cgi, php8.5-cli, php8.5-fpm, libapache2-mod-php8.3, and php8.3-cgi.

What package version is referenced for the PHP 8.5 Ubuntu source package?

The advisory references php8.5 source package version 8.5.9-0ubuntu2.1.

USN-8948-1: PHP vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require local access to the affected system?

Which Ubuntu PHP package deployments should be reviewed?

What package version is referenced for the PHP 8.5 Ubuntu source package?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require local access to the affected system?

Which Ubuntu PHP package deployments should be reviewed?

What package version is referenced for the PHP 8.5 Ubuntu source package?