The PHP development team released emergency security updates on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both flaws are rated 9.2 on the CVSS v4.0 scale and allow remote code execution without authentication.
The patches apply to PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The vulnerabilities affect environments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php setups are noted as particularly high-risk.
CVE-2026-109618 stems from improper memory exhaustion handling, which can lead to memory corruption. CVE-2026-109619 involves the reuse of stale internal state data after memory has been freed, allowing attackers to bypass execution boundaries.
Users running PHP 8.1 or older are not covered by these official updates and must check with their Linux distributions or service providers for backported patches. Administrators are urged to verify their server versions immediately.
The severity of these flaws prompted proactive measures in several regions, including government agencies in the Netherlands and Finland temporarily taking systems offline. Security experts advise monitoring for unauthorized processes or file modifications.
