Critical PHP Vulnerabilities Require Immediate Action

Security advisory for CVE-2026-109618 and CVE-2026-109619

On October 21, 2026 two critical vulnerabilities were discovered that allow an unauthenticated attacker to execute malicious code remotely on a vulnerable server. Organizations should inventory running PHP services and take action immediately.

PHP is a widely used web-services programming language that powers majority of websites and web applications. 

Security agencies have urged organizations using PHP to apply the available updates. Where immediate patching is not feasible, affected systems should be isolated or taken offline until fully mitigated.

Vulnerability Details

CVE-2026-109618 
A memory-corruption flaw in PHP’s out-of-memory handling can allow an unauthenticated attacker to achieve remote code execution.

CVE-2026-109619 
Stale global state can persist between requests and, under vulnerable conditions, be exploited for unauthenticated remote code execution.

PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The mod_php configuration carries the highest risk.

Affected and Fixed Versions

Upgrade to the fixed release for your PHP branch:

These fixed versions were released on October 21, 2026. PHP 8.1 and older branches are end-of-life and do not receive updates from the PHP project.

Recommended Actions

• Patch Immediately
  Upgrade affected systems to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate for the deployed branch.
• Prioritize Internet-Facing Systems
  Identify externally accessible PHP applications and prioritize these assets for emergency remediation. National Security Advisory recommends patching affected assets immediately and considering isolation of Internet-facing applications where patching cannot be completed.
• Address End-of-Life PHP Deployments
  Systems operating PHP 8.1 or earlier should be treated as a priority for migration because these branches no longer receive security fixes from the PHP project.
• Do Not Rely on Application Authentication as Protection
  Application-level authentication does not prevent exploitation because a malicious request can be processed by PHP before application code runs.
• Do Not Rely on session.upload_progress.enabled=0 as a Mitigation
  Datadog Security Labs specifically reports that this configuration change does not protect systems from these vulnerabilities and states that patching is required.
• Investigate Potential Exploitation
  Datadog Security Labs recommends looking for large form submissions, memory-exhaustion errors during request initialization, and unexpected shell processes.

Risks and Impact

Attackers can exploit these vulnerabilities without authentication and run malicious code on affected PHP systems.

Successful exploitation may also expose server files and databases, putting sensitive and business-critical information at risk.

ProArch Security Guidance

• Identify all PHP-based systems and establish their PHP versions.
• Prioritize Internet-facing and externally accessible PHP applications.
• Upgrade supported PHP branches to the applicable fixed release immediately.
• Migrate unsupported PHP 8.1 and earlier installations to a supported version.
• Where patching cannot be completed promptly, evaluate isolation of affected Internet-facing services.
• Review available endpoint and web-server telemetry for indicators consistent with exploitation.
• Ensure relevant security telemetry from affected servers is available to the SOC for investigation.

How ProArch Can Help

ProArch Security Operations is monitoring developments, emerging threat intelligence, and detection opportunities related to these vulnerabilities.

If you need assistance with assessing your exposure, prioritizing remediation, and investigating potential exploitation, contact ProArch.