Critical PHP vulnerabilities: update for CVE-2026-109618 and CVE-2026-109619
Two PHP runtime flaws can allow remote code execution without authentication. Check every web-serving PHP installation and apply a fixed release or a vendor backport.
What happened
On 21 October 2026, the PHP project published fixes for two critical remote code execution vulnerabilities. CVE-2026-109618 concerns memory corruption during out-of-memory handling. CVE-2026-109619 concerns request state that remains accessible after its memory has been freed. These are PHP runtime issues, so reviewing an application or plugin alone is insufficient.
Who should act
Inventory PHP wherever it serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Include packaged applications and appliances with an embedded PHP runtime. The PHP project identifies mod_php as the highest-risk setup because an unauthenticated request can trigger a demonstrated attack before application code runs.
What to do now
Update supported branches to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install a vendor package that backports the fixes. PHP 8.1 and older are outside the project's regular support; check your distribution or product vendor for a maintained fix, or plan an upgrade. Verify the version running in each web server or container after deployment, not only the version installed on the host.
PHP's 23 October follow-up recommends setting session.upload_progress.enabled=0 until the next regular bugfix release to address a separate, unusual remaining path. Treat that setting as an additional precaution, not a substitute for the security update.
