Security Intelligence
Loading table of contents...
At a glance:
-
PHP released emergency updates on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619, vulnerabilities that can allow unauthenticated remote code execution in web-facing PHP deployments.
-
The vulnerabilities affect PHP itself rather than a specific application, exposing a broad range of websites and business applications that rely on PHP processing.
-
Early attack activity was reported shortly after disclosure. The scale of exploitation and number of compromised organizations remain unclear.
Threat summary
An emergency security release from PHP on October 21, 2026 addressed two vulnerabilities that can allow unauthenticated remote code execution.
The release followed the premature disclosure of vulnerability details, which prompted security researchers and defenders to prepare for rapid exploitation activity once patches became available. Early attack activity was reported shortly after disclosure, although the extent of successful exploitation remains unknown.
PHP is a server-side scripting language used to process web requests and generate dynamic content. It serves as the underlying runtime for technologies including:
-
WordPress
-
Drupal
-
Joomla
-
Magento
-
Laravel, and
-
Many internally developed business applications
Because the vulnerabilities reside in the PHP runtime itself, exposure is tied to the underlying PHP installation rather than any individual application.
CVE-2026-109618 affects PHP's handling of out-of-memory conditions during request processing. Under specific circumstances, PHP can terminate request processing while internal request structures remain partially initialized. Cleanup routines may subsequently operate on invalid data, creating a memory corruption condition.
The advisory describes multipart request scenarios capable of reaching the vulnerable code path. PHP states the vulnerability can allow unauthenticated remote code execution.
CVE-2026-109619 is a use-after-free vulnerability involving PHP's request state management. Request-owned state may remain accessible after the memory backing it has been released. A subsequent request handled by the same worker process can access stale state before initialization occurs, creating conditions that can allow unauthenticated remote code execution.
Exploitation happens remotely over HTTP and requires a crafted request to a PHP-handled web endpoint. The request needs no login, no user interaction, and no vulnerable application code, because both flaws trigger before application code runs. Internet exposure of any PHP-served site is the only access condition. PHP rates the risk highest for Apache with mod_php, where it has a demonstrated exploit triggered by a single request.
Both vulnerabilities are rated 9.2 on the Common Vulnerability Scoring System (CVSS) version 4.0.
The vulnerable component is the PHP interpreter, so updating a plugin, theme, or content management system leaves the flaw in place. PHP names PHP-FPM (FastCGI Process Manager), Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed as affected ways of running PHP.
Analysis
These vulnerabilities affect the runtime layer that many organizations depend on. A vulnerable PHP deployment may host multiple websites, APIs, customer portals, and business applications, allowing a single flaw to create exposure across several services simultaneously.
Successful exploitation provides code execution within the PHP process. The resulting impact depends on the resources available to that process, including application data, databases, stored credentials, cloud services, and internal systems accessible from the affected server. The scope of compromise is therefore highly dependent on how the server is deployed and what privileges have been granted to the application.
Apache mod_php deployments warrant particular attention because the demonstrated exploit path executes before application logic is processed. In these environments, application-level security controls may have limited opportunity to inspect or reject malicious requests before the vulnerable PHP functionality is reached.
Mitigations
Upgrade PHP deployments to PHP:
-
8.5.12
-
8.4.27
-
8.3.36 or
-
8.2.35
Applying the updated runtime removes exposure to the vulnerable code paths addressed by CVE-2026-109618 and CVE-2026-109619.
Identify internet-facing systems running PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, or LiteSpeed and prioritize externally exposed deployments. Review Apache mod_php environments as a higher-priority exposure group because PHP documented a demonstrated unauthenticated exploit path that executes before application code is processed.
Monitor web server, application, and endpoint telemetry for unexpected process execution, web shells, file modifications, and suspicious activity originating from PHP worker processes. Reviewing activity around file uploads, multipart requests, and abnormal PHP worker behavior can help identify exploitation attempts and post-compromise activity.
Where immediate patching is not yet complete, disable session.upload_progress.enabled and restart PHP workers to block a confirmed exploitation path associated with CVE-2026-109619. Review upload-related settings, reduce post_max_size, maintain upload_max_filesize below that limit, and enforce request-size controls at web servers and reverse proxies to reduce exposure to the multipart request paths associated with CVE-2026-109618.
PHP notes that these measures reduce exposure to documented attack paths while updates are being deployed and that upgrading remains the complete remediation.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
