The PHP project published a security release on 21 October 2026 (14:00 UTC, which was 01:00 on 22 October in Vanuatu) that fixes two critical remote code execution (RCE) vulnerabilities in the PHP core. This advisory replaces the advance notice CERTVU issued before the release. Both flaws are rated CVSS v4.0 9.2 (Critical), with a network attack vector, no privileges required and high attack complexity, and the same five weaknesses are listed for each: CWE-416 (use after free), CWE-755, CWE-824, CWE-1325 and CWE-1419.

CVE-2026-109618 is an RCE through out-of-memory (OOM) corruption. PHP uses longjmp() to handle out-of-memory errors. If an allocation fails while request memory is only partly initialized, the early exit leaves invalid internal state, and request cleanup then treats it as valid. Oversized or malformed multipart requests are one way to reach the out-of-memory condition. The PHP advisory states the confirmed impact is unauthenticated RCE as the web worker account, validated against mod_php with default settings, where an unauthenticated request triggers the attack before any application code runs.

CVE-2026-109619 is an RCE through stale global state. A persistent PHP worker can keep request-owned internal state that points to memory freed after a previous request. Fatal errors, including out-of-memory errors and execution timeouts, or diagnostics emitted during shutdown can leave this state unreset, and a later request on the same worker may use it before normal initialization, causing a use-after-free. Confirmed early users of the stale state are INI diagnostics and session upload progress handling, and the PHP 8.5 fatal_error_backtraces feature is the confirmed RCE path against mod_php.

PHP states that updating is the only complete fix for both flaws. The PHP announcement does not report exploitation in the wild, but a working exploit has been demonstrated for mod_php. CERTVU understood before the release that all PHP versions from PHP 5 onwards might be affected, whereas the PHP advisories list fixes only for PHP 8.2 to 8.5, with minimal source backports for PHP 7.4, 8.0 and 8.1 published as branches in the php-src repository rather than as releases. The PHP announcement does not give exact affected version ranges, while the GitHub advisories list versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Early reports cited a CVSS score of 10.0, which is not the official rating of 9.2. CERTVU rates this CRITICAL because PHP is very widely deployed, the flaws are unauthenticated and remotely reachable, and a demonstrated exploit exists.

All PHP installations that serve web requests are affected before the fixed releases, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php. The following versions are affected:

• PHP 8.5 before 8.5.12
• PHP 8.4 before 8.4.27
• PHP 8.3 before 8.3.36
• PHP 8.2 before 8.2.35 (PHP 8.2 reaches end of life on 31 December 2026)
• PHP 8.1 and older, which no longer receive releases from the PHP project, including PHP 7.4 and 8.0. Earlier PHP 5 and 7 versions are reported as possibly affected
• Pre-release builds of PHP 8.6.0 before 8.6.0 RC4
• Applications running on PHP, such as WordPress, Joomla and Drupal sites, depend on the PHP version of the host

Not affected / patched version:

• PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later
• PHP 8.6.0 RC4 for the pre-release branch
• For PHP 7.4, 8.0 and 8.1, the PHP security team published minimal source backports as branches in the php-src repository. Some distributions and long-term support vendors also provide backported fixes, so check with your vendor. Where no fix is available, upgrade to a supported branch

Successful exploitation may allow attackers to:

• Send a request that triggers the flaw before any application code runs, and run code on the server as the web worker account without logging in (confirmed for mod_php)
• Install web shells, steal data and credentials held by the web application, and deface or disrupt hosted sites
• Use the compromised web server as a foothold into the hosting network

CERTVU recommends the following:

1. Update PHP

   Update every PHP installation to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, and restart PHP-FPM, Apache and other workers so the new version is running. Shared hosting providers usually apply updates, so ask them when they will deploy. Upgrade PHP 8.1 and older to a supported branch, or apply the security team's backport or a vendor backport. PHP states that only updating is a complete fix.

2. Apply interim measures for CVE-2026-109618 if you cannot update immediately

3. Apply interim measures for CVE-2026-109619

4. Monitor for compromise

   Review web server and PHP logs for oversized or malformed multipart requests, repeated worker crashes or out-of-memory kills, unexpected new files, web shells and unusual child processes of the web server account. Report suspected compromise to CERTVU.

5. Inventory PHP

   Identify every PHP deployment, including web servers, containers, CI images and development machines, record each version and flag unsupported versions for upgrade.