PHP Patches Two Critical Unauthenticated RCE Flaws in Core
Summary
PHP released fixes for two critical, unauthenticated core RCE flaws, CVE-2026-109618 and CVE-2026-109619. The article details affected versions, exposure-reduction measures, detection, and why updating is the only complete mitigation.
Key points
- PHP rated both flaws CVSS v4.0 9.2; the vulnerabilities affect PHP core and can enable unauthenticated remote code execution.
- CVE-2026-109618 involves out-of-memory handling and cleanup of partially initialized request data; CVE-2026-109619 involves stale per-request global state.
- PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches need a vendor or source backport, or an upgrade.
- PHP says interim settings can reduce exposure but do not make an installation safe; updating is the only complete mitigation.
- The article recommends checking the PHP runtime serving each site, restarting or verifying replacement of workers, and investigating crashes, unusual child processes, and outbound connections.
- A scan counted about 884,000 internet-facing hosts reporting PHP 8.1 or older; the article cautions these version banners do not confirm vulnerability.
Article Details
- Vulnerability Types
- Out-of-memory handling can interrupt request processing while internal request data is partially initialized, allowing cleanup of invalid data.
- Stale global state can persist between requests after its backing memory is freed and be used before normal initialization.
- Severity
- CVSS v4.0 9.2 (Critical), as rated by PHP's security team.
- Affected Versions
- PHP 5.x
- PHP 7.4
- PHP 8.0
- PHP 8.1
- PHP 8.2
- PHP 8.3
- PHP 8.4
- PHP 8.5
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2026-109618, PHP's interim guidance includes limiting decoded request size, input field count, multipart part count, headers per part, and nesting depth; these measures reduce exposure but are not a complete mitigation.
- Administratively setting memory_limit=-1 removes the predictable PHP memory-limit trigger for CVE-2026-109618, but underlying allocation failures may still reach the vulnerable path.
- For CVE-2026-109619, disabling session.upload_progress blocks confirmed session-related paths but not other variants.
- On PHP 8.5, setting fatal_error_backtraces=0 is listed as an interim exposure-reduction measure.
CVE
CVE-2026-109618PHP shipped an out-of-cycle security release on October 21, 2026, for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which its security team rated CVSS v4.0 9.2 (Critical).CVE-2026-109619PHP shipped an out-of-cycle security release on October 21, 2026, for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which its security team rated CVSS v4.0 9.2 (Critical).
Vendors
Products
PHPPHP shipped an out-of-cycle security release on October 21, 2026, for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which its security team rated CVSS v4.0 9.2 (Critical).Picus Platformto test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Platform.