Critical PHP Vulnerabilities: Two CVEs Could Enable Unauthenticated Remote Code Execution – CVE-2026-109618 & CVE-2026-109619

Published: October 22, 2026
Category: Cybersecurity, DevOps, Application Security
Estimated reading time: 8–10 minutes

Two critical vulnerabilities in PHP have triggered an urgent security advisory from the PHP development team. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow remote attackers to execute arbitrary code on vulnerable servers without authentication.

On October 21, 2026, the PHP team released security updates addressing both vulnerabilities. Organizations running PHP-powered websites, APIs, content management systems, and backend services should identify affected installations and prioritize patching.

The risk is particularly important for internet-facing applications, where an attacker may be able to reach the vulnerable PHP runtime simply by sending a crafted HTTP request.

Security status: Critical
CVSS severity: 9.2 for both vulnerabilities, according to the PHP team’s advisory
Primary risk: Unauthenticated remote code execution (RCE)
Recommended action: Upgrade to a fixed PHP release or apply the appropriate vendor security update immediately.

Official advisory: https://www.php.net/archive/2026.php

1. What Is the PHP Security Issue?

PHP is a widely used server-side programming language that powers websites, APIs, e-commerce platforms, and content management systems such as WordPress, Drupal, and Joomla.

When a web request reaches a PHP application, the PHP runtime processes the request, manages memory, executes application code, and generates a response.

The newly disclosed vulnerabilities affect internal PHP runtime operations involved in memory allocation and request-state management.

Under certain conditions, these flaws can corrupt internal memory or cause the runtime to use invalid internal state. A successful attack could allow an unauthenticated attacker to execute code on the affected server.

This is more serious than a typical application-level vulnerability because the issue exists within the PHP runtime itself. Depending on the deployment configuration and exploitation path, an attacker may be able to reach the vulnerable code before the application has an opportunity to perform its own authentication checks.

However, successful exploitation is not guaranteed for every PHP installation. The practical risk depends on the PHP version, runtime configuration, deployment model, and reachable attack path.

2. Understanding the Two Vulnerabilities

CVE-2026-109618: Memory corruption during out-of-memory handling

The first vulnerability involves improper handling of memory-allocation failures.

Applications and runtimes must handle situations in which the system cannot allocate additional memory. PHP uses internal mechanisms to manage these failures and clean up request-related data.

The problem occurs when an allocation failure interrupts initialization or processing, leaving internal data structures in an incomplete state. Subsequent cleanup operations may incorrectly treat that state as valid.

This can result in memory corruption and, under exploitable conditions, remote code execution.

Why it matters: A specially crafted request may trigger the problematic execution path without requiring a valid application account.

CVE-2026-109619: Use of stale internal request state

The second vulnerability involves stale internal state associated with request processing.

When PHP releases memory or finishes processing request-related data, references to that data must no longer be used. If internal state survives after the backing memory has been freed, subsequent operations may access invalid memory.

This class of defect is commonly known as a use-after-free vulnerability.

Depending on the execution path and memory layout, a use-after-free defect can cause crashes, memory corruption, information exposure, or potentially arbitrary code execution.

Why it matters: If an attacker can influence the relevant processing path, invalid memory access may become a route to compromising the PHP process.

Both vulnerabilities affect the security of the PHP runtime rather than being limited to one particular PHP application or plugin.

3. What Is Remote Code Execution (RCE)?

Remote code execution occurs when an attacker can cause a system to execute commands or code remotely.

In an unauthenticated RCE scenario, the attacker does not necessarily need a username, password, API token, or existing application session to reach the vulnerable functionality.

For a vulnerable PHP server, successful exploitation could allow an attacker to execute code with the privileges of the compromised PHP process.

Depending on those privileges and the surrounding security controls, the consequences may include:

Reading application configuration files and accessible secrets.
Accessing database credentials or API tokens stored in the application environment.
Modifying application files or injecting malicious code.
Accessing sensitive information available to the compromised process.
Using the compromised application as a foothold for further attacks.
Disrupting application availability or attempting lateral movement into other systems.

These are potential consequences of successful exploitation, not proof that every affected server has already been compromised.

The actual impact depends on the attacker’s access, the permissions of the PHP process, network segmentation, secret management, and other security controls.

4. Which PHP Deployments Are at Risk?

According to the official advisory, the vulnerabilities affect PHP installations serving web requests across several runtime configurations.

Examples include:

PHP-FPM: Commonly used with Nginx and Apache. Exposed applications may be at risk when requests can reach vulnerable PHP processing paths.

Apache with mod_php: The PHP team identifies this configuration as particularly concerning because a demonstrated exploit can reach the vulnerable code before application code runs.

php-cgi: Applications using the CGI-based PHP runtime should also be assessed.

FrankenPHP and LiteSpeed: These deployment configurations are included in the PHP team’s advisory.

Docker and Kubernetes workloads: Containerization does not eliminate a vulnerability in the PHP runtime. Containers using affected PHP builds require remediation.

WordPress and other CMS platforms: These applications may be affected when they run on a vulnerable PHP runtime. Updating WordPress core or plugins alone does not patch the underlying PHP engine.

Which versions should be checked?

The PHP team released the following security-fixed versions:

PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Earlier releases in these branches should be treated as potentially affected until updated or otherwise confirmed remediated by the relevant vendor.

PHP 8.1 and older branches also require attention. Some are end-of-life and may not receive upstream security updates. Organizations using these versions should plan migration to a supported branch or obtain an appropriate vendor-supported security fix.

Important: Linux distributions sometimes backport security patches without changing the upstream PHP version to the same fixed release number. Check the distribution’s security advisory and package changelog before concluding that a package is vulnerable based on its version string alone.

References:

PHP security advisory: https://www.php.net/archive/2026.php
PHP downloads: https://www.php.net/downloads.php

5. Why Internet-Facing Applications Need Immediate Attention

Internet-facing PHP services accept requests from potentially untrusted clients. If the vulnerable code is reachable through the deployed runtime, an attacker may attempt exploitation without first compromising an application account.

Commonly exposed workloads include:

Public-facing websites and WordPress installations.
E-commerce applications and payment-related web services.
PHP-based REST APIs.
Customer portals and internal applications exposed through public endpoints.
Backend services running PHP behind a reverse proxy or load balancer.

An application does not need to have a known vulnerable plugin for a runtime-level vulnerability to be relevant.

Likewise, placing a PHP application behind a load balancer or web application firewall does not automatically eliminate the underlying risk.

Network restrictions and application-layer filtering can reduce exposure, but they should not be considered a replacement for the security update.

6. How to Check Whether Your Infrastructure Uses an Affected PHP Version

The first step is to identify every PHP runtime across development, testing, staging, and production environments.

Do not limit the investigation to the primary web server. PHP may also be installed in worker containers, scheduled jobs, administrative tools, and separate backend services.

Step 1: Check the PHP version on a server

Run:

php -v

To identify the executable being used:

which php

On Linux systems using PHP-FPM, inspect the installed service and package information:

systemctl status php-fpm

The actual service name may be version-specific, such as php8.3-fpm.

For Debian or Ubuntu:

dpkg -l | grep -E 'php[0-9.-]*|php-fpm'

For RHEL-compatible distributions:

rpm -qa | grep -i php

A CLI version check alone is insufficient. The command-line PHP binary may differ from the PHP-FPM or Apache module used by the live application.

Step 2: Check PHP in Docker images

For a running container:

docker exec <container_name> php -v

Inspect the image used by a container:

docker inspect <container_name> \
  --format '{{.Config.Image}}'

Review the Dockerfile and dependency pipeline to identify the PHP base image.

For example, if the application uses:

FROM php:8.3-fpm

Update the image reference to a fixed release tag appropriate for the deployment and architecture. Verify that the tag exists and that the image contains the expected patched runtime before rollout.

Do not rely on a running container’s version alone if the image registry, Dockerfile, or deployment manifest still references an outdated image.

Step 3: Check PHP workloads in Kubernetes

List running pods:

kubectl get pods -A -o wide

Inspect the images configured for a specific workload:

kubectl get deployment -n <namespace> \
  <deployment_name> \
  -o jsonpath='{.spec.template.spec.containers[*].image}'

For a container running PHP:

kubectl exec -n <namespace> <pod_name> \
  -c <container_name> -- php -v

Some production images do not include a PHP CLI binary, so verify their image provenance and package contents using the appropriate build or image-scanning process.

Also inspect CronJobs, Jobs, and other workloads that may use separate PHP images.

Step 4: Review image registries and CI/CD pipelines

Search your Dockerfiles, Helm values, Kubernetes manifests, and deployment configuration for PHP image references.

Examples of places to check include:

GitHub Actions build and deployment workflows.
Amazon ECR and other container registries.
Helm charts and Kubernetes deployment manifests.
Docker Compose files.
Infrastructure-as-code repositories.
Third-party or vendor-provided application images.

Identify which images are actively deployed, which are scheduled for deployment, and which older images remain available for rollback.

The objective is to establish an accurate inventory before beginning remediation.

7. How to Remediate the Vulnerabilities

The PHP team’s advisory states that there are no complete mitigations and that updating is the only safe choice.

The remediation plan should prioritize externally reachable production services while ensuring that all other affected installations are addressed.

Step 1: Upgrade PHP to a security-fixed release

Select the appropriate fixed version for the application’s PHP branch.

For example:

PHP 8.5 installations: upgrade to 8.5.12 or a later release containing the fixes.
PHP 8.4 installations: upgrade to 8.4.27 or a later release containing the fixes.
PHP 8.3 installations: upgrade to 8.3.36 or a later release containing the fixes.
PHP 8.2 installations: upgrade to 8.2.35 or a later release containing the fixes.

For older, unsupported branches, use a supported migration path or a verified security update from the operating-system vendor.

Step 2: Rebuild Docker images

Avoid treating an in-place change inside a running container as the final remediation.

Update the Dockerfile or base image reference, rebuild the application image, scan it, and publish it to the container registry.

A typical pipeline might follow this sequence:

Update the PHP base image.
Build the application image.
Run automated tests.
Scan the resulting image and its packages.
Push the image to the registry.
Deploy the updated image through the normal release process.

Ensure that the resulting image actually contains the patched PHP runtime. A new application image built from an old base image does not resolve the issue.

Step 3: Roll out the fixed image in Kubernetes

Update the image reference in the relevant Deployment, StatefulSet, CronJob, or other workload configuration.

For example:

kubectl set image deployment/<deployment_name> \
  <container_name>=<fixed_image_reference> \
  -n <namespace>

This command is an example of updating a Deployment. In GitOps-managed or Helm-managed environments, update the source configuration and let the normal deployment process apply the change instead of making an unmanaged live change.

Monitor rollout progress:

kubectl rollout status deployment/<deployment_name> \
  -n <namespace>

Then verify the running pods and their images:

kubectl get pods -n <namespace> -o wide

Do not stop after a successful rollout. Confirm that every replica uses the expected image and that no old vulnerable workload remains active.

Step 4: Test application functionality

Security updates should be validated against the application’s normal operating requirements.

Recommended checks include:

Application startup and readiness.
Health endpoints and API responses.
Authentication and authorization flows.
Database connectivity.
Background workers and scheduled jobs.
Error rates, latency, and application logs.

If the upgrade exposes compatibility issues, resolve them through a controlled release process. Do not leave the vulnerable runtime deployed indefinitely because testing was not completed.

Step 5: Verify the fix

Verification should combine package-level evidence, image provenance, deployment state, and runtime checks.

A successful deployment does not necessarily prove that every PHP component has been patched.

Confirm that:

The installed PHP package or image contains the security fix.
The running PHP-FPM, Apache, or other relevant runtime is using the updated build.
Old replicas and outdated images are no longer deployed.
Scheduled and background workloads have been updated.
The relevant vendor security advisory confirms the package’s patched status.

8. Recommended Response for DevOps and Security Teams

Organizations managing multiple applications or environments should handle this as a coordinated vulnerability-remediation exercise.

Inventory: Identify all PHP installations, including hosts, containers, Kubernetes workloads, and managed application platforms.

Prioritize: Start with internet-facing production services, followed by other reachable services and internal workloads.

Patch: Upgrade to the fixed PHP release or a verified vendor-patched package.

Rebuild: Publish new container images and update deployment definitions.

Deploy: Roll out the fix using the organization’s normal CI/CD process.

Validate: Confirm the runtime version, workload health, application functionality, and security scan results.

Document: Record affected assets, image digests, deployed versions, remediation timestamps, and any exceptions.

Additional hardening measures

The following measures help reduce the potential impact of runtime vulnerabilities:

Run PHP processes with the least privileges necessary.
Avoid storing long-lived credentials in container images or source repositories.
Restrict unnecessary outbound network access from application workloads.
Keep databases and administrative interfaces off public networks where possible.
Use centralized logging and alerting to identify suspicious behavior.
Maintain a reliable process for tracking vulnerabilities in base images and application dependencies.

These are defense-in-depth controls. They do not replace patching the affected PHP runtime.

9. What About WordPress Websites?

WordPress site owners should verify the PHP version used by the actual production website, not simply check whether WordPress core is up to date.

If the website uses a vulnerable PHP runtime, updating themes and plugins alone will not resolve the underlying runtime issue.

Recommended actions for WordPress administrators:

Check the PHP version through the hosting control panel or the site’s Site Health information.
Ask the hosting provider whether the deployed PHP runtime contains the relevant security fixes.
Upgrade to a fixed, supported PHP version where the hosting environment permits it.
Test the website, plugins, themes, and integrations after upgrading.
Verify that any staging environments and separate PHP-based services are also addressed.

Shared hosting customers may not have direct access to the PHP runtime or system packages. In that case, contact the hosting provider and request confirmation of the applicable security update.

A website backup is valuable for recovery, but it is not a substitute for patching a vulnerable runtime.

10. Can a Web Application Firewall Prevent This Attack?

A web application firewall (WAF), reverse proxy, or network firewall may help reduce exposure by blocking certain requests or restricting access to an application.

However, these controls should not be treated as a reliable standalone fix for the two PHP vulnerabilities.

The affected functionality exists within the runtime, and a filter that does not recognize a particular attack pattern may fail to block it.

The PHP team’s advisory explicitly states that there are no complete mitigations.

Therefore, temporary restrictions may be useful as additional risk-reduction measures while an update is being prepared, but the priority remains deploying a fixed runtime.

11. Incident Response: What If a Server Was Running a Vulnerable Version?

Finding an affected PHP version does not automatically mean that the server has been exploited.

Nevertheless, if a potentially vulnerable internet-facing system was exposed, organizations should assess whether there are indicators of compromise.

Recommended actions include:

Review web server, PHP, system, and security monitoring logs for unusual activity.
Investigate unexpected processes, file changes, and outbound network connections.
Check for unexpected modifications to application code or configuration.
Assess whether the PHP process could access sensitive credentials or internal services.
Rotate credentials if there is evidence that they may have been exposed.
Preserve relevant logs and forensic evidence if compromise is suspected.

Do not rely solely on HTTP access logs to prove that exploitation did not occur. If compromise is suspected, follow the organization’s incident-response procedures and involve the security team.

Patching prevents continued exposure to the fixed vulnerability; it does not establish whether a previous compromise occurred or remove an attacker’s persistence.

12. Final Recommendations

The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 demonstrate why runtime security must be treated as part of application security.

Even well-maintained applications can be exposed when their underlying language runtime contains a critical vulnerability.

Organizations should prioritize the following actions:

Inventory PHP versions across servers, containers, and production workloads.
Identify externally reachable PHP services.
Apply the appropriate fixed release or verified vendor security update.
Rebuild and redeploy container images through CI/CD.
Verify that all active replicas and background workloads are patched.
Investigate potential compromise where exposure or suspicious activity warrants it.
Improve ongoing vulnerability inventory, image scanning, and patch-management automation.

The key takeaway: Do not assume that a website is protected simply because its application code is current. The PHP runtime itself must also be patched.

For the latest version information and remediation guidance, consult the official PHP security advisory:

https://www.php.net/archive/2026.php

Official References

PHP Security Advisory — Critical Remote Code Execution Vulnerabilities
https://www.php.net/archive/2026.php
PHP Official Downloads
https://www.php.net/downloads.php
Canadian Centre for Cyber Security — PHP Critical Vulnerabilities
https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
NHS England Digital — Critical PHP Vulnerabilities
https://digital.nhs.uk/cyber-alerts/2026/cc-4875

Disclaimer: This article is intended for security awareness and defensive remediation. Always verify the affected package versions and applicable fixes against the official PHP advisory and your operating-system or hosting vendor’s security guidance.