PHP Security Releases Fix Two Critical RCE Vulnerabilities
The PHP development team has released urgent security updates across all active release branches addressing two critical remote code execution vulnerabilities.
PHP Security Releases Fix Two Critical RCE Vulnerabilities
The PHP core development team announced urgent security updates for all supported PHP versions. These releases remediate two critical vulnerabilities that could allow remote attackers to achieve arbitrary code execution under specific server environments.
Vulnerability Overview
The reported issues involve memory corruption during multipart form-data parsing and an integer overflow vulnerability within the multibyte string extension (mbstring). Systems parsing untrusted file uploads or processing complex Unicode encodings are strongly advised to patch immediately.
- CVE-2026-4821: Remote code execution via crafted multipart form boundaries.
- CVE-2026-4822: Heap buffer overflow in
mb_ereg_*functions during regex evaluation.
Recommended Action
All developers and infrastructure operators should upgrade their runtime environments immediately:
# Ubuntu / Debian
sudo apt-get update && sudo apt-get --only-upgrade install php8.3 php8.2
# Alpine Linux / Docker
apk update && apk upgrade php83
Ensure that all web worker processes (PHP-FPM, RoadRunner, FrankenPHP, Swoole) are fully restarted after applying the updates to load the patched shared libraries.