Critical PHP Vulnerabilities Could Allow Remote Code Execution on Web Servers

Two critical security vulnerabilities have been discovered in PHP, potentially allowing attackers to execute malicious code on vulnerable servers without authentication. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime used by millions of websites and web applications.

The PHP development team released security updates on 21 October 2026, urging administrators to update affected installations as soon as possible.

Both vulnerabilities are rated Critical, with a CVSS severity score of 9.2, according to Google Cloud’s security advisory. The issues stem from weaknesses in PHP’s handling of memory and internal request data, which could allow attackers to exploit the way the runtime processes web requests.

Out-of-memory corruption vulnerability

The first vulnerability, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), is described as remote code execution through out-of-memory (OOM) corruption.

The flaw occurs when PHP runs out of memory while internal request data is only partially initialised. During subsequent request cleanup, PHP may incorrectly treat this incomplete data as valid, potentially creating an opportunity for memory corruption and arbitrary code execution.

Stale global state vulnerability

The second issue, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), involves stale global state left behind after a request has finished.

Internal data belonging to a request can remain accessible after the memory supporting it has been freed. If another request is handled by the same worker, PHP may use this outdated state before its normal initialisation process resets it. Under the right conditions, this could also lead to remote code execution.

The vulnerabilities are particularly concerning because they affect the PHP runtime itself rather than being limited to a specific website or application.

Which systems are affected?

According to the PHP project’s security announcement, the risk extends to PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The development team identifies Apache’s mod_php configuration as particularly high risk, citing a demonstrated exploit that can be triggered by an unauthenticated request before application code runs.

PHP powers a substantial proportion of the internet, including content management systems, online shops and business applications. Consequently, vulnerable installations could expose website operators and hosting providers to significant security risks.

Updates released

The PHP project has released patched versions for its supported branches:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Administrators should upgrade to the appropriate fixed version and check with their operating system or hosting provider for updated packages. Websites running PHP through containers should also ensure their images are rebuilt and redeployed with a patched release.

Organisations unable to update immediately should review the PHP project’s official security advisory for temporary risk-reduction measures. These measures can reduce exposure to particular attack paths but are not a substitute for installing the fixes.

The disclosure highlights the importance of keeping server-side software up to date, particularly when vulnerabilities can be exploited remotely without requiring an attacker to log in.

Further technical details and mitigation guidance are available in the official advisories for CVE-2026-109618 and CVE-2026-109619, alongside the PHP project’s security announcement.