Two critical PHP vulnerabilities affect web servers

The first signs of the memory issue were identified during a PHP audit in 2024, but the specific remote code execution vectors were not confirmed until August 2026, when several teams reported them to the project. The first exploitation attempt recorded by telemetry dates back to 17 October, four days before the public disclosure and the release of the fixes. On 20 October, the early release of the identifiers led the project to bring forward the publication by one day.

The vulnerabilities CVE-2026-109618 and CVE-2026-109619, with a CVSS score of 9.2, affect memory handling and internal state management between requests, and could allow an unauthenticated attacker to execute code with web server privileges. The risk affects PHP installations that process web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, provided code fixes for some older branches, and noted that temporary mitigations are no substitute for updating.

The latest official update states that both vulnerabilities were added to CISA’s catalogue of known exploited vulnerabilities on 26 October. Updating to the patched versions remains the primary course of action, whilst systems that cannot be updated should be isolated from public networks until the fix has been applied and verified.