Critical PHP Flaws Enable Unauthenticated Remote Code Execution
Summary
PHP released fixes for two critical flaws that can allow unauthenticated remote code execution in web-serving installations. Rapid7 urges emergency updates, noting research exploits and the prospect of public release.
Key points
- CVE-2026-109618 involves memory corruption during out-of-memory handling; CVE-2026-109619 is a use-after-free involving state retained between requests. Both are rated CVSSv4 9.2.
- The article reports demonstrated remote code execution paths in Apache mod_php and PHP-FPM, with exploitability depending on the vulnerability and server configuration.
- The PHP project released fixes. Fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12; organizations should use packages containing both complete fixes.
- Research exploits were developed, and the article reports indications of independent reproduction; public release of a viable exploit was expected soon as of October 21, 2026.
- Temporary configuration changes can reduce exposure to specific paths but are not complete remediation. Rapid7 recommends emergency patching and restarting affected workers after configuration changes.
- PHP 8.1 and older no longer receive routine upstream updates; the article advises obtaining vendor fixes, applying available source backports, or upgrading.
Article Details
- Vulnerability Types
- Memory corruption during out-of-memory handling
- Use-after-free involving state retained between requests
- Severity
- Critical; both vulnerabilities have a CVSSv4 score of 9.2 and can allow unauthenticated remote code execution with web-worker privileges.
- Affected Versions
- PHP 8.2 before 8.2.35
- PHP 8.3 before 8.3.36
- PHP 8.4 before 8.4.27
- PHP 8.5 before 8.5.12
- Exploitation Status
- reported
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- For the OOM issue, administratively set memory_limit=-1 and restart every worker; this reduces exposure to the confirmed exploit path but does not prevent underlying allocation failures.
- For confirmed session lifecycle paths, administratively set session.upload_progress.enabled=0 before request parsing and restart every worker.
- On PHP 8.5, administratively set fatal_error_backtraces=0 and restart every worker to address the confirmed fatal backtrace path.
CVE
CVE-2026-10961821, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-freeCVE-2026-109619in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2
Vendors
Products
Apache mod_phpAll installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before anyExposure CommandExposure Command, Vulnerability Management, and NexposeFrankenPHPAll installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before anyLiteSpeedserving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before any applicationNexposeExposure Command, Vulnerability Management, and NexposePHPOn October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-freePHP-CGIAll installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before anyPHP-FPMAll installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the highest risk because exploitation can succeed before anyVelociraptorA Velociraptor Artifact Generic.Applications.PHPInventory is available to inventory PHP installations on Windows, Linux and macOS for remediation scoping. This artifact allows for the collection of package versions,Vulnerability ManagementExposure Command, Vulnerability Management, and Nexpose