PHP Disrupts Code Execution Flaws with Emergency Patches

Both flaws are rated 9.2 on the CVSS v4.0 scale and carry the identifiers CVE-2026-109618 and CVE-2026-109619, and the PHP project says only updating fully protects a server.

CVE-2026-109618 and CVE-2026-109619: scope and impact

PHP released emergency updates on October 21 that fix two critical remote code execution flaws that live in the PHP runtime itself. The fixes appear in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP security advisory, the defects affect nearly every PHP version back to PHP 5.4 and therefore threaten every PHP installation that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Because the bugs are in the engine rather than in application code, a site with a simple “Hello World” page on a vulnerable PHP version can be attacked. The advisory singles out Apache's mod_php as the highest risk, citing a demonstrated exploit in which a single unauthenticated request triggers the attack before any application code runs. PHP-FPM behaves differently in that it can shut a worker down when a request fails early in setup; for one flaw PHP’s analysis supports that FPM is susceptible but no complete FPM exploit has been shown, while the other flaw reached code execution on both mod_php and PHP-FPM depending on an operation inside the running application.

What to install and immediate operational steps

PHP’s instruction is simple and absolute: update the PHP runtime that serves web requests, then restart Apache, PHP-FPM, and any long-running PHP workers. Updating an application such as WordPress or Laravel does not update the PHP runtime; the runtime comes from the server package, the host, or the container image. The advisory also notes that PHP 8.1 and older no longer receive updates from the PHP project and that PHP 8.2 reaches end of life on December 31, 2026.

For administrators building from source or awaiting vendor packages, the PHP security team published source backports for PHP 7.4, 8.0, and 8.1. Linux distributions and long-term-support vendors received the patches in advance, so a distribution package may carry the fix under an old-looking version number — administrators should check the package changelog for the CVE rather than relying solely on the version string.

Partial mitigations — what works, what does not

• For CVE-2026-109618: set memory_limit=-1 so applications cannot override it, keep post_max_size low, and enforce request-size limits at the web server or proxy. PHP warns that RLIMIT_AS or RLIMIT_DATA can trigger the same vulnerable path and should not be used as substitutes.
• For CVE-2026-109619: set session.upload_progress.enabled=0 and restart every worker; additionally, on PHP 8.5 set fatal_error_backtraces=0. Turning off session upload progress blocks the confirmed session paths but not other variants, and the advisory stresses that no configuration change fully mitigates this flaw short of updating.

PHP also added a new hard memory limit in the fix; reaching it ends the process and stops shutdown handlers from running, so administrators are advised to review memory_limit and post_max_size against what their applications need after updating.

“The only thing I can say is that the only mitigation is patching/upgrading PHP. I sadly know too much,” PHP core developer Gina Peter Banyard wrote before the release, responding to suggestions that configuration tweaks might suffice.

Evidence of exploit attempts and organizational responses

Before the patch shipped, Cloudflare reported early attempts to exploit the flaws. “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” Cloudflare CTO Dane Knecht said, calling the firewall rules Cloudflare deployed a stopgap and urging administrators to patch. No source has confirmed a successful break-in: watchTowr, which reproduced CVE-2026-109618, reported no exploitation in the wild as of 11:26 UTC on October 21, and neither flaw was in CISA's Known Exploited Vulnerabilities catalog at that time.

Some organizations took services offline as a precaution. BambooHR took its service offline across the United States, Canada and Ireland and warned that payroll would be interrupted. In the Netherlands, NOS reported that MijnOverheid, DigiD, the lower house of parliament's site, the national cyber-security center and several education systems went offline; the centre said it had not seen the flaw abused but urged everyone to patch.

If administrators suspect an earlier compromise, researchers suggest watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oddly large PHPSESSID response cookies, and unexplained restarts of PHP workers.

How security teams, Linux distributions, and application owners should respond

• Security teams: Prioritize updating the runtime that serves web requests and restarting long-running workers; treat the advisory's suggested configuration changes only as temporary, partial mitigations. Monitor logs for the indicators researchers recommended.
• Linux distributions and vendors: Verify that packages carry the CVE in the changelog and communicate clearly to downstream users when a package contains the backported fix under an unchanged-looking version string.
• Application owners and hosts: Do not assume application updates protect you — confirm the PHP runtime your service uses, apply vendor or source patches, and restart all PHP workers after patching.

The disclosure followed a leak on October 20 that accelerated the release timetable; PHP published the fixes around the scheduled 14:00 UTC release time on October 21. Researchers at Wiz, OpenAI's Codex Security team, and Google's Gemini team worked with the PHP security team on the fix, and the researchers said AI models helped turn longstanding code defects into working exploits — “letting one researcher do in about a week what they say would otherwise have taken a team months,” and that knowing the target’s history still mattered for developing the exploit.

Original story