On 21 October 2026, two critical vulnerabilities affecting PHP were disclosed under the references CVE-2026-109618 and CVE-2026-109619. With a CVSS score of 9.2/10 each, these flaws could allow a remote attacker to execute arbitrary code on a vulnerable server without prior authentication.
The PHP team issued an initial communication on 20 October 2026, announcing that patches would be available the following day at 4:00 PM Paris time.
CVE-2026-109618 and CVE-2026-109619: two critical vulnerabilities at the heart of PHP
These two vulnerabilities directly affect the PHP execution engine. They stem from memory management errors that can lead to memory corruption and, under certain conditions, Remote Code Execution (RCE).
CVE-2026-109618:
An unauthenticated remote attacker can trigger out-of-memory conditions in PHP to corrupt memory and achieve remote code execution on web servers. The severity is critical and the situation is urgent, as several national CERTs have issued urgent advisories regarding the active availability of security patches and the risk of total system compromise without authentication.
CVE-2026-109619:
A memory state tracking error in the PHP engine allows an unauthenticated remote attacker to trigger a use-after-free condition by exploiting a stale global state that references freed memory, leading to arbitrary remote code execution on all major web server configurations, including Apache, Nginx, and PHP-FPM. The severity is critical and the situation is urgent: several national CERTs have issued urgent warnings for a coordinated patch release, and the vulnerability affects the core language runtime used by the majority of the web, creating a massive attack surface despite the absence of a confirmed public exploit.
Which PHP versions are affected?
The vulnerabilities affect the following PHP versions:
All PHP 5.x versions
All PHP 6.x versions
All PHP 7.x versions
All PHP 8.0.x versions
All PHP 8.1.x versions
PHP 8.2.x versions prior to 8.2.35
PHP 8.3.x versions prior to 8.3.36
PHP 8.4.x versions prior to 8.4.27
PHP 8.5.x versions prior to 8.5.12
For PHP versions 5.x, 6.x, 7.x, 8.0.x and 8.1.x, no patches are being provided under official PHP support, as these branches have reached their end of life.
Which environments are exposed?
The vulnerabilities affect various PHP execution modes, including environments relying on Apache with mod_php and PHP-FPM.
Exploitation conditions vary depending on the configuration. Some scenarios have been demonstrated on mod_php and PHP-FPM, while other environments may require additional conditions.
Web servers accessible from the internet are a priority, as they can receive specially crafted requests designed to trigger the vulnerable behaviours.
How can I detect CVE-2026-109618 and CVE-2026-109619?
Check whether you are using one of the PHP versions mentioned earlier in this article.
Users of the vulnerability management platform Cyberwatch can already detect this vulnerability as of 21 October 2026. Please do not hesitate to contact our team for any further information.
