Key points
- PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 contain fixes for CVE-2026-109618 and CVE-2026-109619.
- Both vulnerabilities carry a CVSS score of 9.2 and enable remote code execution via memory corruption or stale state.
- CERT-EU advises immediate patching or isolation of internet-facing applications until updates are verified.
Two critical vulnerabilities in the PHP scripting language allow unauthenticated remote code execution, creating immediate risk for web servers worldwide. The PHP project released patches on 21 October 2026 to address CVE-2026-109618 and CVE-2026-109619. According to CERT-EU, technical details are now public and initial proofs of concept have begun circulating. This exposure increases the likelihood that attackers are actively exploiting these flaws to compromise systems before administrators can apply fixes.
By the numbers
- CVSS 9.2: The severity score assigned to both CVE-2026-109618 and CVE-2026-109619 by the PHP security team.
- 21 October 2026: The date the PHP project released security updates for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- 14:00 UTC: The originally scheduled release time, though patches were available at 13:30 UTC on the same day.
What the figures mean
The high severity scores reflect the ease with which attackers can exploit these flaws without authentication. CVE-2026-109618 arises from memory corruption during out-of-memory handling. When PHP enforces its memory limit using longjmp(), it can interrupt request processing while internal data is only partially initialized. Cleanup routines may then treat this invalid data as valid and attempt to free memory that was never properly initialized, potentially exposing attacker-controlled data from earlier allocations.
CVE-2026-109619 stems from stale global state persisting after a request's backing memory is freed, such as following a fatal error. A subsequent request handled by the same worker process may utilize this stale state before normal initialization resets it. Both flaws allow an exploit to trigger with a single unauthenticated request, executing code before any application logic runs. This bypasses standard security controls and application-level input validation.
What to watch
Every PHP installation serving web requests faces risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. CERT-EU identifies the mod_php setup as the highest-risk configuration due to its integration with the Apache server process. End-of-life branches, specifically PHP 8.1 and older, do not receive official updates from the PHP project. However, some Linux distributions and long-term support vendors provide backported fixes. Organizations using these older versions must verify vendor support or apply minimal source backports published by the PHP security team.
Users of the volunteer-maintained rpms.remirepo.net repository should note that updates will not be available on release day. The PHP team urges these users to switch to official distribution packages or build from source. Additionally, many commercial and open-source products embed PHP as a backend technology without exposing it directly. CERT-EU recommends consulting the NCSC-NL GitHub repository to identify third-party software that may be impacted by these underlying vulnerabilities.
Infection and persistence in general
Remote code execution flaws typically arrive via crafted network requests that trigger memory errors or state inconsistencies in the target application. Attackers often use these initial access vectors to deploy web shells or reverse shells for persistent command and control. Analysts usually examine web server access logs for unusual request patterns, such as high-frequency queries or payloads containing encoded commands.
Persistence mechanisms often involve modifying configuration files or injecting malicious scripts into legitimate directories. Teams should check for unauthorized modifications to system binaries and review active processes for unexpected network connections to external command and control servers.
Background: Memory corruption vulnerabilities
Memory corruption occurs when software writes data outside its allocated memory space, overwriting adjacent variables or code. This allows attackers to hijack program execution, escalate privileges, or crash systems. It affects any application managing memory directly, including operating systems, browsers, and embedded devices. Prevention requires strict memory management and modern compiler protections.
Read the full guide: Memory Corruption Vulnerabilities: Definition, Mechanisms, and Mitigation
What to do and how to stay safe: PHP
- Patch all affected PHP installations immediately to versions 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or the latest available patch for your specific distribution.
- Isolate internet-facing applications from public networks if immediate patching is not feasible, until the fix is applied and verified.
- Set memory_limit=-1 in a way that applications cannot override it, such as using php_admin_value in FPM pools or Apache configuration files.
- Consult the NCSC-NL GitHub repository to identify and update any third-party software that embeds PHP and may be vulnerable to these flaws.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are older PHP versions like 8.1 supported with patches?
No, PHP 8.1 and older are end-of-life and do not receive official updates, though some vendors provide backports or minimal source patches.
Can I mitigate the risk without patching?
Setting memory_limit=-1 reduces exposure to the specific attack path in CVE-2026-109618 but does not make the installation safe against CVE-2026-109619.
Which PHP configuration is most at risk?
CERT-EU considers the Apache mod_php setup to be the highest-risk configuration among all PHP installation types.
