Critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619 #
Update (October 27, 2026): Evidence indicates that CVE-2026-109618 and CVE-2026-109619 are actively exploited in the wild, leading to their addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026.
Update (October 21, 2026): This post has been updated with details from the PHP Project's security advisory, including affected versions, fixes, and mitigations.
The PHP Project has released a security update that addresses two critical vulnerabilities, collectively known as "php2shell". Both are rated CVSS 9.2 and can allow unauthenticated remote code execution:
- CVE-2026-109618: PHP handles out-of-memory (OOM) errors by exiting the current context with longjmp(), which can interrupt PHP while request data is only partially initialized. Request cleanup may then read or branch on the invalid data, allowing an unauthenticated, remote attacker to execute arbitrary code. Crafted multipart requests can trigger the condition, and with Apache mod_php it can occur before any application code runs. The vulnerability has been designated CVE-2026-109618 and has been rated critical with a CVSS score of 9.2.
- CVE-2026-109619: PHP retains global state that points to memory owned by a request. If that state is not reset before the request memory is freed, a later request handled by the same worker can use the stale state before normal initialization, allowing an unauthenticated, remote attacker to execute arbitrary code. The vulnerability has been designated CVE-2026-109619 and has been rated critical with a CVSS score of 9.2.
All PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Applications that run on PHP, such as content management systems, e-commerce platforms, and web frameworks, may be exposed through a vulnerable PHP runtime.
The following versions are affected
- PHP 8.2: Versions prior to 8.2.35
- PHP 8.3: Versions prior to 8.3.36
- PHP 8.4: Versions prior to 8.4.27
- PHP 8.5: Versions prior to 8.5.12
Note: PHP 8.1 and earlier no longer receive updates from the PHP Project and should be considered vulnerable unless a distribution or LTS vendor has backported the fixes.
What is PHP? #
PHP is a widely used open-source, general-purpose scripting language for web development. It runs web applications and content management systems, often through mod_php, PHP-FPM, or CGI.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an unauthenticated remote attacker to execute arbitrary code with the privileges of the underlying PHP process, potentially leading to full compromise of affected web applications and underlying server infrastructure.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- PHP 8.2: Upgrade to version 8.2.35 or later.
- PHP 8.3: Upgrade to version 8.3.36 or later.
- PHP 8.4: Upgrade to version 8.4.27 or later.
- PHP 8.5: Upgrade to version 8.5.12 or later.
- PHP 8.1 and earlier: Migrate to a supported fixed release, or obtain a backported fix from your distribution or LTS vendor.
Note: Linux distributions and LTS vendors received the patches in advance; check your vendor for updated packages. The PHP security team also provided minimal source backports for PHP 7.4, 8.0, and 8.1 for those building from source.
Mitigation:
- Updating is the only complete mitigation. The following measures reduce exposure to specific attack paths but do not make an installation safe.
- CVE-2026-109618: Set memory_limit=-1 in a way applications cannot override, set a low post_max_size, and enforce request size, multipart part, header, and nesting limits at the web server or proxy.
- CVE-2026-109619: Set session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0, restart all workers, and remove invalid or deprecated per-request settings that emit diagnostics before request initialization.
- Review the PHP security advisory and the linked GitHub Security Advisories for additional mitigation details.
Finding exposed PHP installations with runZero #
From the Software Inventory, use the following query to locate systems running potentially vulnerable software:
vendor:=PHP AND product:=PHP
