Critical PHP Security Issue: CVE-2026-109618 and CVE-2026-109619

Organisations are being urged to take immediate action to mitigate a critical security issue affecting PHP. PHP has published a security update for a flaw that may allow attackers to execute commands on any web server running PHP. The alert was published on 21 October 2026 and updated on 22 October 2026.

What has happened?

The issue could let an attacker trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. The issue has now been fixed. The two vulnerabilities are described as follows:

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

Who is affected?

Organisations using any version of PHP are affected, and all are highly encouraged to update to the latest fixed version. Those running older versions are encouraged to move to a fully supported release. Because PHP is also bundled into other products, exposure may extend beyond servers where you installed PHP yourself.

What should you do?

Follow vendor best-practice advice and these priority actions:

1. Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated versions.
2. Update to the latest version of PHP and keep monitoring for further updates.
3. If you cannot update, apply the temporary mitigations provided by the PHP Foundation.
4. If you cannot apply the mitigations, or doing so would take too long, consider taking the system offline until it is fully mitigated.
5. If you can neither update nor disable the system, assess it for evidence of compromise and backdoors before upgrading or mitigating. If you are not confident doing this yourself, get help from a qualified cyber incident response↗ provider.
6. Continuously monitor security updates from third-party vendors, including appliances and services that may bundle PHP, and apply them as they become available.

Notes for security teams

Because the flaw can lead to unauthenticated remote code execution, internet-facing PHP applications should be handled first. Do not limit your inventory to web servers: admin panels, content management systems and other products that bundle PHP may be in scope. Speed up your patching process for this event, and review logs and file integrity for signs of prior compromise before you apply the fix.

Source: https://www.php.net/archive/2026.php#2026-10-21-5