PHP CVE-2026-109618 and CVE-2026-109619: Critical RCE Vulnerabilities Explained

Introduction

Short answer:** PHP released security updates on 21 October 2026 for two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP project says the flaws can affect web-facing installations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators should identify the PHP runtime actually serving requests, apply a supported vendor update, restart the relevant workers and verify that the patched version is running. [1] [2]

**Key Takeaways**

- CVE-2026-109618 and CVE-2026-109619 are critical PHP vulnerabilities that can enable unauthenticated remote code execution through memory-handling failures.

- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the project’s fixes; PHP 8.1 and older require a maintained distribution backport or an upgrade path.

- A version check must cover the web-serving runtime, not only the PHP binary used by a developer’s command line.

- Configuration workarounds can reduce specific attack paths, but the PHP project says updating is the complete solution.

- India-based teams should treat internet-facing PHP, CMS and hosting panels as an exposure-prioritisation task and preserve logs before making disruptive changes.

What are CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 is a PHP remote-code-execution vulnerability involving out-of-memory error handling. The PHP advisory explains that an interruption during an out-of-memory path can leave internal request data only partly initialised. Cleanup code may then process invalid data as if it were valid. That memory-safety failure can be turned into code execution under the conditions described by the advisory. [1]

CVE-2026-109619 is a separate remote-code-execution flaw involving stale global state. In the affected path, request-owned internal state can continue pointing at memory that has already been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it. [1] [2]

These descriptions explain why the issue is broader than a vulnerable PHP application function. The risk is connected to the runtime and the way it handles web requests. A site owner can therefore have an application with no newly disclosed bug and still need to assess the PHP process serving that application.

Who may be exposed?

The PHP project lists installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisory identifies mod_php as a particularly important concern because the demonstrated exploit path can be reached by an unauthenticated request before application code runs. [1]

The practical exposure question is not simply, “Does this server have PHP installed?” It is, “Which PHP runtime handles requests for an internet-facing hostname, and which version and build does that runtime use?” A machine can contain several PHP versions. The command-line `php -v` result may not match the FPM pool, Apache module or LiteSpeed handler used by the public website.

Shared hosting, managed WordPress hosting, control panels, container images and custom PHP stacks can all have different update procedures. The responsible administrator should identify the owner of the runtime and the supported package channel before changing files manually.

Which PHP versions fix the vulnerabilities?

The PHP project lists these security releases as fixing both vulnerabilities:

PHP 8.1 and older no longer receive updates from the PHP project. Some Linux distributions and long-term-support vendors may provide backported fixes, and the PHP project also lists minimal source backports for some older branches. That does not mean every old installation is safe. Administrators must confirm the patch status with the operating-system or hosting vendor and document the exact package or build installed. [1]

PHP 8.2 is scheduled to reach end of life on 31 December 2026 according to the PHP archive. Teams still using that branch should treat the current update as an urgent patch and plan a supported-branch migration rather than relying on an extended exception. [1]

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

How should a website owner check exposure safely?

Start with an inventory, not an immediate restart. Record the public hostnames, operating system, PHP handler, PHP-FPM pools, Apache or LiteSpeed integration, container image, CMS version and package source. For managed hosting, ask the provider which fixed package is active rather than assuming a local command reflects the public runtime.

Next, check the web-serving version through the approved administration path. Avoid exposing a public `phpinfo()` page or placing version details in a response that unauthenticated visitors can read. If a temporary diagnostic is necessary, restrict it to an administrator-only channel and remove it after the check.

Review access logs, error logs and process telemetry before a major restart. Unit 42 reported proof of concept and said its telemetry identified more than 22.6 million potentially exposed instances; that figure is provider telemetry, not a count of confirmed compromises. It is useful as an exposure signal, not proof that every installation has been attacked. [2]

What is the safest patching sequence?

### 1. Confirm the maintenance path

Use the operating-system repository, the hosting provider’s supported package, or the PHP project’s documented release process. Avoid downloading an unverified binary from a message, mirror or random repository. Confirm the package signature or vendor checksum when the channel provides one.

### 2. Patch the runtime that serves traffic

Update the relevant PHP package or image to a fixed release. On a multi-version host, update the active FPM pool, Apache module, CGI handler or LiteSpeed mapping rather than only the default shell binary. Keep a record of the previous package and configuration so rollback remains possible.

### 3. Restart and verify every worker

Restart the affected service using the platform’s normal procedure. Then verify the active process, FPM pool and public application path. A successful package installation is not enough if old workers continue serving requests. Check that the service is healthy and that the intended PHP version is now attached to the correct virtual host.

### 4. Recheck application behavior

Run the site’s normal health checks, login flow and critical content routes. Watch for upload, import, queue and background-worker errors. Compare error rates before and after the restart. Preserve evidence if the server shows unexplained crashes, memory failures or suspicious child-process activity.

### 5. Review the perimeter

Restrict administrative interfaces to trusted networks or a controlled jump host. Apply least privilege to service accounts, review exposed management ports and ensure logs are retained. These controls reduce the chance that a runtime weakness becomes a wider incident, but they do not replace patching.

Do temporary mitigations replace the PHP update?

No. The PHP project describes configuration measures that can reduce specific attack paths when an immediate update is impossible. Examples include setting an appropriate `memory_limit` policy, limiting request and upload sizes, disabling `session.upload_progress.enabled` before request parsing, and disabling certain PHP 8.5 fatal-error backtraces. The exact setting must be applied in a configuration layer that affects the worker before request parsing, and workers must be restarted. [1]

These measures are not a complete fix. They may block a confirmed path while leaving other ways to reach the underlying vulnerable code. Do not treat a mitigation checklist as evidence that an unpatched public PHP service is safe. Use it only as a temporary risk-reduction step while the supported update is prepared.

What should Indian organisations prioritise?

Indian businesses should begin with internet-facing systems that process customer data, payments, identity information or business workflows. Include WordPress and other CMS installations, customer portals, APIs, legacy applications, control-panel-managed sites and vendor-hosted services. A small organisation may not have a full asset-management platform, so a dated spreadsheet containing hostname, owner, runtime, version, package source, patch date and verification result is still better than an untracked assumption.

For regulated or contract-bound environments, coordinate the patch with the organisation’s incident-response and reporting procedures. CERT-In’s vulnerability-notice system is a useful official source for India-facing advisories, but this PHP issue should still be assessed against the exact operating-system package and hosting environment. Do not infer a reporting duty from a news article; check the applicable rule, contract or official direction.

If evidence suggests compromise, preserve logs, process information and relevant configuration before rebuilding or deleting artefacts. Isolate the affected service using the incident plan, rotate credentials only through an approved procedure and seek qualified incident-response assistance where required. This article is defensive education, not a substitute for an incident investigation.

Frequently asked questions

### Can an unauthenticated attacker exploit these PHP flaws?

The PHP project describes both vulnerabilities as capable of unauthenticated remote code execution in affected web-serving configurations. Actual exposure depends on the runtime, handler, version, configuration and reachable attack path. Patch the serving runtime rather than relying on application-level assumptions. [1]

### Is PHP 8.3.36 fixed?

Yes. The PHP project lists PHP 8.3.36 among the releases that fix CVE-2026-109618 and CVE-2026-109619. Verify that the public web handler is using that fixed build and that old workers were restarted. [1]

### Is PHP 8.1 safe if the operating system still supports it?

Do not assume that. PHP 8.1 and older no longer receive updates from the PHP project, although some distributions and long-term-support vendors may provide backports. Confirm the vendor’s exact advisory and package status, or move to a supported PHP branch. [1]

### Does changing `memory_limit` fix CVE-2026-109618?

No. The PHP project presents configuration changes as temporary risk reduction for specific paths. Updating to a fixed release remains the complete solution. [1]

### Does this mean every PHP website has been hacked?

No. A vulnerable version indicates potential exposure, not confirmed compromise. Administrators should patch, review relevant telemetry and investigate unusual activity rather than making an unsupported breach claim.

Conclusion

CVE-2026-109618 and CVE-2026-109619 deserve fast, evidence-led patching because they affect the PHP runtime that sits beneath many websites and applications. The first action is to identify the PHP handler serving public requests. The next is to apply a supported fixed release, restart the workers, verify the live path and preserve enough telemetry to investigate if anything looks abnormal. Temporary configuration changes may narrow some attack paths, but they do not turn an unpatched public runtime into a safe one.

Internal reading

• [Understanding zero-day vulnerabilities](/articles/understanding-zero-day-vulnerabilities)
• [Basic network security concepts](/articles/basic-network-security-concepts)
• [Cybersecurity vs. information security](/articles/cybersecurity-vs-information-security)

Decision checklist

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
• [Understanding zero-day vulnerabilities](/articles/understanding-zero-day-vulnerabilities)
• [Basic network security concepts](/articles/basic-network-security-concepts)
• [Cybersecurity vs. information security](/articles/cybersecurity-vs-information-security)

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. php.net — PHP Security Advisory and 2026 Archive
2. unit42.paloaltonetworks.com — Unit 42 PHP Vulnerability Threat Brief
3. security.paloaltonetworks.com — Palo Alto Networks Security Advisory CVE-2026-109618
4. cisa.gov — CISA Known Exploited Vulnerabilities Catalog