PHP RCE Flaws CVE-2026-109618, 109619: Patch Now

Patch now: if you run PHP 8.2, 8.3, 8.4 or 8.5 behind mod_php, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed, update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 immediately. The PHP project shipped these builds on October 21, 2026 to fix two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, and CISA added both to its Known Exploited Vulnerabilities catalog on October 26 after reports of in-the-wild exploitation. Both carry a CVSS v4.0 score of 9.2.

What happened

On October 21, 2026, the PHP development team quietly pushed out point releases for every supported branch — 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — alongside two GitHub Security Advisories on the official php-src repository: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). Both advisories carry the vendor's own CVSS v4.0 rating of 9.2, in the critical band, and both describe paths to full remote code execution over plain HTTP requests, no authentication needed.

Five days later, on October 26, CISA added both CVE IDs to its Known Exploited Vulnerabilities (KEV) catalog. The Canadian Centre for Cyber Security's own alert, AL26-026, was updated on October 27 to state that "open-source reporting indicates that CVE-2026-109618 and CVE-2026-109619 are being exploited in the wild," a change from its original text, which had only noted that proof-of-concept exploit details were circulating. That is the signal that turns this from "patch when convenient" into "patch today": PHP still powers a large share of the web's server-side code, and these two bugs sit in the engine itself, not in a plugin or framework layered on top.

The two flaws, in plain terms

Both vulnerabilities live in how PHP's engine handles memory and state around the edges of a request's lifecycle, rather than in any specific function you call from your own code. That is part of why they are so serious: a site doesn't need to call a dangerous function to be exposed, it just needs to be running PHP to serve requests.

CVE-2026-109618: out-of-memory state corruption

PHP has long used a C-level longjmp() to bail out immediately when a request hits its memory limit. According to the php-src advisory, if that out-of-memory interruption happens while request-scoped memory is only partially initialized, PHP's request-shutdown routine can go on to process that invalid, half-built state as if it were valid. The advisory says researchers triggered the condition through multipart form parsing — specifically requests with a missing content-length header, an unbounded number of headers, or empty file-upload fields carrying nested array names — and from there demonstrated full remote code execution over HTTP against a default mod_php configuration. PHP's fix removes the hard longjmp() exit for out-of-memory conditions and replaces it with a "soft" out-of-memory check at the next safe point in the virtual machine, escalating to a hard _exit() only if memory pressure continues past a higher threshold.

CVE-2026-109619: state that outlives its own memory

The second flaw is a classic use-after-free, but triggered through PHP's internal lifecycle rather than application code. The php-src advisory explains that global engine state — covering errors, sessions, objects and loaded extensions — can persist inside a worker process after the request that created it has already ended, and that state can still point at memory that has since been freed. Certain operations that run early, before a new request has been fully initialized, read that stale state, producing a use-after-free that the advisory says a crafted heap layout can turn into remote code execution. PHP's own write-up says the clearest path runs through fatal-error backtraces (including out-of-memory and script-timeout fatals) and through session-upload-progress handling during INI processing — both were "validated against mod_php," and the session-lifecycle path was also validated against PHP-FPM.

Both numbers come straight from the vendor's own advisories on the php-src security advisory page, cross-checked against the official PHP 8 ChangeLog, which lists both GHSA IDs under the October 22, 2026 entries for 8.4.27 and 8.5.12.

Who is actually exposed

The php-src advisories and the Canadian Centre for Cyber Security's alert both frame exposure around how PHP is deployed to handle web traffic, not just which version number shows up in phpinfo(). Setups called out by name include Apache with mod_php, PHP-FPM (the most common pairing with Nginx), php-cgi, FrankenPHP, and LiteSpeed's LSAPI. The vendor advisory for CVE-2026-109618 states that full RCE was validated specifically against mod_php with default settings, that FPM has not had a complete working exploit demonstrated yet, and that FrankenPHP and LiteSpeed are considered likely susceptible but unvalidated. For CVE-2026-109619, the advisory says the session-lifecycle path was validated against both mod_php and FPM, which is the more immediately concerning of the two for the typical Nginx-plus-FPM hosting stack most production PHP sites run today.

Shared hosting providers, managed WordPress and Drupal hosts, and any self-managed VPS running a LAMP or LEMP stack are all in scope if the PHP build is older than the fixed versions above. PHP 8.1 and earlier branches no longer receive security updates from the PHP project at all, so sites still running them cannot get a vendor patch for these flaws and need to upgrade to a supported branch first.

Timeline: from quiet patch to KEV listing

The sequence of events here is worth tracking closely, because it shows how fast a "just a patch Tuesday" release can turn into an active-exploitation emergency. PHP shipped the fixed builds on October 21, 2026, with the two GitHub Security Advisories published the same day, each carrying the vendor's own 9.2 CVSS v4.0 score and a description of a validated remote-code-execution path. At that point, the Canadian Centre for Cyber Security's original alert text described proof-of-concept exploit code as available but noted no confirmed active exploitation. Five days later, on October 26, CISA added both CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. The Centre updated its own alert the following day, October 27, replacing the earlier "PoC only" language with a direct statement that open-source reporting showed both flaws being exploited in the wild. For defenders, that one-week gap between "patch available" and "confirmed under attack" is the window that matters most — it's exactly the period during which unpatched, internet-facing PHP servers are most likely to be swept up in opportunistic scanning before patch rates climb.

Is this actually being exploited?

Yes, according to government tracking, though the picture evolved over about a week. When PHP first shipped the fix on October 21, researchers had working proof-of-concept exploit code but no confirmed in-the-wild attacks had been reported. CISA's addition of both CVE IDs to its KEV catalog on October 26 changed that, and the Canadian Centre for Cyber Security's own alert was updated the next day specifically to add the sentence that open-source reporting indicated active exploitation. A KEV listing is a meaningful signal on its own: it means a U.S. federal civilian agency is now required to remediate on an accelerated timeline, and it generally reflects corroborated evidence of real attacks, not just a working lab exploit. Palo Alto Networks' Cortex Xpanse telemetry, cited independently, put the number of internet-facing, potentially vulnerable PHP instances in the tens of millions, which is consistent with why this pair of bugs drew KEV attention so quickly after disclosure.

If you can't patch immediately

The php-src advisories are explicit that none of the following steps are a substitute for upgrading, only a way to reduce exposure while an update is scheduled. For CVE-2026-109619, the advisory recommends setting fatal_error_backtraces=0 on PHP 8.5 installs that cannot yet update, since the fatal-backtrace path is one of the confirmed routes to the bug. It also suggests disabling session.upload_progress.enabled if your application doesn't rely on that feature, since session-upload-progress handling is one of the "consuming operations" the advisory names. For CVE-2026-109618, lowering memory_limit extremes or tightening multipart upload limits (max header count, required content-length) can reduce the attack surface the researchers used to trigger the out-of-memory condition, but the vendor is clear that configuration changes do not fully close either hole — only the point releases do.

Why the blast radius is so wide

PHP's own project describes these as engine-level bugs rather than application-level ones, and that distinction is what makes the scope so broad. WordPress, Drupal, Magento, Laravel, Symfony and countless custom LAMP/LEMP applications all run on top of the same PHP binary, so a flaw in how that binary handles out-of-memory conditions or request-state cleanup affects every one of them identically, regardless of which framework or CMS sits on top. A site owner can have a fully patched WordPress install, every plugin up to date, and still be exposed, because the vulnerability has nothing to do with WordPress — it's in the interpreter underneath it. That's also why the fix required a full point release of the PHP runtime itself (8.2.35, 8.3.36, 8.4.27, 8.5.12) rather than a framework-level hotfix, and why hosting providers and system administrators, not individual application developers, are the ones who need to act first.

Why a PHP engine bug matters beyond your own code

Unlike a vulnerability in a specific CMS plugin or a third-party library you can simply remove, these flaws sit in the PHP runtime that every application on the server depends on. A compromised PHP host is also a favorite building block for the kind of large-scale botnet infrastructure attackers use for further scanning and credential-stuffing campaigns, so patching your own servers isn't just about protecting your own data — it's about not becoming someone else's launchpad. It's a similar dynamic to other recent runtime-level disclosures, including the Brotli decompression flaw that hit Node.js and .NET and the Linux kernel flaw CISA flagged under active attack this same month: when the vulnerability is in the platform itself rather than an app built on top of it, every workload on that platform inherits the risk until the underlying runtime is updated.

What to do now

Check every server, container image and CI pipeline that runs PHP, and confirm the installed version is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. If you manage shared hosting, VPS instances or Docker base images, rebuild and redeploy with the patched PHP packages rather than relying on a host-level package manager update alone, since cached container layers can keep shipping the vulnerable binary long after the base image updater runs. If you're stuck on PHP 8.1 or older, prioritize moving to a supported branch, since no security fix for these CVEs exists for end-of-life versions. Finally, if you can't patch every server today, apply the fatal_error_backtraces=0 and multipart/upload-progress mitigations above as a stop-gap, and track your remaining unpatched hosts the same way you'd track any other item on an active KEV list — because, per CISA and the Canadian Centre for Cyber Security, that's exactly what this is now.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage