Two critical vulnerabilities in PHP, disclosed 21 October 2026, allow remote code execution on web-facing servers without authentication. Both are rated CVSS 9.2.
CVE-2026-109618 — RCE via out-of-memory corruption. PHP can be interrupted while request data is only partially initialised, and cleanup then treats that invalid data as valid.
CVE-2026-109619 — RCE via stale global state. Request-owned internal state can outlive the memory backing it, and a later request on the same worker may act on what's left behind.
FIXED RELEASES
→ PHP 8.5.12
→ PHP 8.4.27
→ PHP 8.3.36
→ PHP 8.2.35
PHP 8.1 and earlier have no official release. Use your distribution or LTS vendor package, the PHP project's minimal source backports, or upgrade to a supported branch. PHP 7.3 and older have no fix at all.
Note that vendor packages are frequently backported, so a patched Debian, Ubuntu or RHEL build may report a version number that doesn't match the upstream list above. Check your vendor's advisory, not just `php -v`.
WHAT TO DO
✔ Update PHP and any bundled runtimes
✔ Check containers, images and hosting control panels — not just your main host
✔ Review logs for suspicious activity
Every PHP installation serving web requests is in scope: PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. Apache with mod_php is the highest priority, because an attack can land before any of your application code runs.
Two things worth being honest about: the PHP project states that no configuration change fully mitigates these issues — firewall rules and settings reduce exposure, they do not fix it. And exploitation attempts were recorded in a honeypot on 17 October, four days before public disclosure, so assume this is actively being looked for.
—
#Astmation — #software #systems, #automation, and #AI-powered #applications.
Build. Automate. Evolve.
https://astmation.com/
Watch on YouTube