TT-CSIRT – 462.21.10.26- Critical Remote Code Execution Vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619)
Please be advised that two critical vulnerabilities, designated as CVE-2026-109618 and CVE-2026-109619, have been identified in PHP. Successful exploitation may allow an unauthenticated threat actor to execute malicious code remotely with the privileges of the affected PHP web-server process, potentially compromising hosted applications and associated systems.
Please note: The PHP Security Team issued advance notice on 20 October 2026 and published security updates on 21 October 2026. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical). The vendor has demonstrated unauthenticated exploitation involving Apache mod_php; the published announcements do not confirm widespread active exploitation in the wild.
CVE-2026-109618 involves out-of-memory (OOM) handling that can leave request data incompletely initialized.
CVE-2026-109619 involves stale request-owned global state being accessed after the associated memory has been freed, potentially during a subsequent request handled by the same worker.
Affected Systems and Remediations.
Affected deployments include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The vendor identifies Apache mod_php as the highest-risk configuration. The following PHP releases contain fixes for both vulnerabilities:
| Product | Affected Versions | Recommended Solution |
| PHP 8.5 | Versions earlier than 8.5.12 | Upgrade to PHP 8.5.12 or a verified vendor-patched package |
| PHP 8.4 | Versions earlier than 8.4.27 | Upgrade to PHP 8.4.27 or a verified vendor-patched package |
| PHP 8.3 | Versions earlier than 8.3.36 | Upgrade to PHP 8.3.36 or a verified vendor-patched package |
| PHP 8.2 | Versions earlier than 8.2.35 | Upgrade to PHP 8.2.35; plan migration before end of support |
| PHP 8.1 and older | Unsupported by PHP project | Upgrade to a supported fixed branch, or obtain verified LTS vendor backports |
Workarounds and Mitigation Measures
Customers and system administrators are strongly advised to implement the following measures to reduce exposure to these vulnerabilities:
- Apply the available PHP security updates
- Upgrade to the relevant fixed release listed above or apply an equivalent verified vendor security update. Rebuild and redeploy affected containers where applicable.
- Restart all PHP workers and affected web services after updating. Verify the version serving live web requests, rather than relying solely on the command-line PHP version.
2. Reduce out-of-memory exploitation exposure (CVE-2026-109618)
- Where an immediate update is not possible, PHP recommends administratively setting memory_limit=-1, while retaining separate container/cgroup memory protections. This is only a temporary risk reduction and may introduce resource-exhaustion concerns.
- Limit request bodies and multipart parsing at the web server or reverse proxy. Keep post_max_size conservative, require upload_max_filesize below that limit, and restrict excessive headers, fields, uploads and nesting.
3. Reduce stale global state exploitation exposure (CVE-2026-109619)
- Set session.upload_progress.enabled=0 in server-level configuration and restart every PHP worker. This blocks a confirmed path but is not a complete workaround.
- On PHP 8.5, also set fatal_error_backtraces=0 and restart workers. Remove invalid or deprecated per-request PHP settings that trigger diagnostics before request initialization.
4. Strengthen monitoring and incident response readiness
- Review HTTP access logs, PHP and application error logs, worker restarts, fatal errors and unexplained child-process activity. Preserve relevant evidence if compromise is suspected.
- Restrict unnecessary exposure to vulnerable applications until patching is complete, and assess services that execute PHP code with elevated operating-system permissions.
Important: The PHP Security Team states that no configuration workaround fully addresses these issues. Installing a fixed or verified vendor-patched release is the only complete remediation.
Indicators of Compromise (IoCs)
The PHP project has not published confirmed malicious IP addresses, domains, file hashes or host identifiers linked to these vulnerabilities however organizations may nevertheless investigate the following potential indicators:
- Unusual or repeated multipart/form-data requests, especially requests with excessive fields, headers or anomalous lengths.
- Unexpected PHP memory exhaustion, fatal errors, deprecation warnings or repeated PHP worker crashes.
- Unexplained processes initiated by PHP web-server accounts or unusual outbound connections from affected servers.
These behaviours are investigative leads and should not be treated as confirmed proof of compromise on their own.
Reference(s):
https://www.php.net/archive/2026.phphttps://www.php.net/archive/2026.php
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79whttps://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rphttps://www.php.net/downloads.php
Contact Information:
If you have any queries, comments or require assistance, please feel free to contact the TT-CSIRT via contacts@ttcsirt.gov.tt
