Critical PHP RCE flaws: CVE-2026-109618 and CVE-2026-109619

The PHP team has issued urgent updates for two critical unauthenticated remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS 4.0 score of 9.2. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

This is not a bulletin to leave for the next routine maintenance window. PHP confirms that an HTTP request can lead to code execution with the web process’s privileges. Public servers using Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed deserve the highest priority.

Breachroad’s conclusion: updating is the safe response; trying to compensate solely with configuration changes or WAF rules is not. The vendor explicitly says there is no complete workaround. Organisations should identify exposure, deploy the fix, prove that it is live and investigate signs of misuse in parallel.

What happened

On 21 October 2026, PHP published four security releases:

• PHP 8.5.12;
• PHP 8.4.27;
• PHP 8.3.36;
• PHP 8.2.35.

They address two distinct flaws with a similar outcome. CVE-2026-109618 concerns memory corruption after an allocation failure. CVE-2026-109619 involves stale global state being reused across request-processing stages. Researchers confirmed unauthenticated remote code execution for both.

Exploitation does not automatically mean system-wide administrator access. Code initially runs as the PHP web-process account. That may still be enough to read application configuration, database credentials, API tokens and customer files, alter application code or prepare a privilege-escalation path.

Who is exposed

The official notice covers PHP installations serving web requests, including:

• Apache with mod_php;
• PHP-FPM behind Nginx or Apache;
• php-cgi;
• FrankenPHP;
• LiteSpeed and other integrations using a vulnerable runtime.

The risk is not limited to bespoke PHP applications. It also applies to content-management systems, online stores, employee portals, partner panels and legacy applications when their effective interpreter is vulnerable. Checking only the WordPress, Drupal, Magento or framework version is not sufficient.

Teams should also inspect container images, serverless services with custom runtimes, test servers, forgotten administration panels and supplier-managed hosts. A corrected image tag does not prove that every running replica has been replaced.

Why the vulnerabilities are particularly serious

The first flaw can exploit a condition where an attacker-controlled request causes memory exhaustion or allocation failure, after which error handling leaves the process in an unsafe state. Researchers confirmed complete RCE over HTTP against mod_php in an ordinary multi-process configuration.

The second vulnerability abuses state that was not cleared correctly. Its advisory documents confirmed paths through error handling and session lifecycle behaviour for both mod_php and PHP-FPM. The relevant requests may need to reach the same worker, but adding workers merely lowers the probability of an individual attempt; it does not remove the flaw.

That distinction matters to decision-makers. “We run several workers” or “a load balancer distributes traffic” is not a credible control. Exploit complexity may affect reliability, but it does not change the potential impact.

What organisations should do today

1. Inventory versions that are actually running

Do not rely on a repository declaration. Inspect live containers, virtual machines, hosting platforms, workers and environments restored from images. The owner of each service should confirm the runtime version, the web-server integration and internet exposure.

2. Upgrade to a fixed release

The minimum fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. An older branch is not safe merely because no new package exists for it. The appropriate response is migration to a supported line.

PHP also notes that the 8.2 branch reaches end of security support on 31 December 2026. Moving to 8.2.35 closes this issue but does not solve the approaching lifecycle problem.

3. Patch every node and restart workers

Verify the package or image source, run compatibility checks, deploy in controlled stages and restart every process that may still hold the old library or binary runtime. Read the version from the running process afterwards. A successful build is not proof of successful production deployment.

4. Reduce exposure while patching

If the update cannot be completed immediately, restrict public reachability, isolate administration panels, reduce web-account privileges and strengthen request limits at the reverse proxy. The official guidance includes settings that narrow some confirmed paths, but it does not describe a complete substitute for the update.

5. Triage in parallel

Preserve reverse-proxy, WAF, HTTP server, PHP and operating-system logs. Look for unusual sequences of large or malformed requests, worker restarts, allocation errors, new application files, shell execution by the web account and unexpected outbound traffic.

The absence of a ready-made signature is not evidence that no attack occurred. Correlate process behaviour with deployment history, file changes and activity involving secrets available to the application.

Mistakes to avoid

• Do not postpone the update simply because your feeds do not yet show a public exploit.
• Do not treat one WAF rule as a complete replacement for the fix.
• Do not check only the host package when the application runs in a container or brings its own runtime.
• Do not restart blindly before preserving relevant logs and volatile evidence when compromise is suspected.
• Do not rotate every credential without a plan. Identify what the web process could access, map dependencies and then rotate in a controlled order.

A decision checklist for non-technical leaders

A business owner does not need to analyse process memory. They do need unambiguous answers from IT or the service provider:

1. Does any public service use PHP?
2. Which version is each node actually running?
3. When did every instance receive the fix and restart?
4. How was the new live version verified?
5. Which logs were examined and were suspicious signals found?
6. Which secrets were available to the web process?

If a supplier operates the service, “automatic updates are enabled” is not enough. Ask for the version, deployment time, instance coverage and verification result. Those are meaningful technical facts that can be shared without exposing sensitive configuration.

Source facts and Breachroad’s analysis

PHP confirms the two critical vulnerabilities, unauthenticated RCE impact, covered web environments, fixed releases and the absence of a complete mitigation that replaces upgrading. The project advisories document confirmed impact on mod_php and PHP-FPM and explain the limits of partial workarounds.

Prioritising internet-facing services, inventory design, parallel triage, supplier questions and deployment evidence are Breachroad recommendations. Integrate them into a repeatable vulnerability management process and incident response plan. Technical teams and service owners can rehearse the same decisions through cybersecurity training for organisations, while an IT security audit can assess real server exposure.

Primary sources: PHP — security advisory and releases published 21 October 2026, GHSA-w8hw-w9fx-j79w — RCE via OOM corruption, GHSA-6wmf-4rv5-p3rp — RCE via stale global state.