CVE-2026-109618 and CVE-2026-109619 — two critical, unauthenticated remote-code-execution flaws — were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and all PHP users are being urged to update immediately.
The technical faults: out-of-memory corruption and stale global state
PHP maintainers describe two distinct failure modes that can lead to remote code execution. CVE-2026-109618 is an out-of-memory (OOM) corruption issue: out-of-memory handling can interrupt PHP while internal request data are only partially initialized, and subsequent request cleanup can treat that invalid data as valid. CVE-2026-109619 involves stale global state: request-owned internal state can survive after the backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it. Both vulnerabilities allow unauthenticated attackers to run code on affected servers.
Software and deployments at risk: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed
The advisory explicitly names all PHP installations that serve web requests as at risk. This list includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The maintainers identify the highest risk for sites running mod_php: there is a demonstrated exploit path where an unauthenticated HTTP request can trigger the attack before any application code runs.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExploitability and the demonstrated mod_php path
Both flaws are described as enabling unauthenticated remote code execution, but the advisory singles out mod_php with a concrete demonstration: an unauthenticated request can trigger the vulnerability prior to any application-level initialization. That timing — an attack surface that exists before application code executes — elevates severity for servers using mod_php, where the runtime can be interrupted or left in a state that permits arbitrary actions during request cleanup or when stale state is reused.
Immediate remediation: upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35
PHP maintainers released fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advisory is unequivocal about the remedy: "Updating PHP is the only way to regain security. Do it now." Administrators running any PHP build that serves web requests should prioritize applying these updates and verifying that the patched versions are in production. No alternative mitigations are presented in the advisory; the only corrective action named is updating PHP to a fixed release.
How technologists, procurement teams, and adversaries are likely to respond
- Technologists and security teams: validate which PHP builds are in use (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), deploy the fixed versions listed above, and confirm through testing that patched binaries are serving live traffic. Given the advisory's emphasis on an exploit that can run before application code executes, special attention should be paid to mod_php deployments.
- Affected enterprises and procurement leaders: accelerate change-control windows and coordinate with hosting and platform providers to ensure the fixed PHP releases are rolled out across managed and self-hosted environments, especially where legacy integrations continue to use mod_php or php-cgi.
- Adversaries and threat actors: with a demonstrated exploit path for mod_php and an explicit assertion of unauthenticated remote-code-execution potential, attackers will likely scan for unpatched servers; defenders should assume such scanning will escalate until the fixed releases are broadly deployed.
The record in this advisory is short and stark: two critical implementation defects in PHP runtime handling can yield unauthenticated remote code execution, and the published fix releases are the only remedy provided. For any organization that serves web traffic with PHP, the choice is clear — identify exposed PHP endpoints now and apply one of the fixed releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35) without delay.
