PHP Releases Critical Security Updates for Two Remote Code Execution Vulnerabilities

PHP has released security updates for four supported release branches after identifying two critical remote code execution (RCE) vulnerabilities. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely without authentication under vulnerable configurations.

The PHP development team published the advisory on 21 October 2026 and strongly urged administrators to install the updated releases. PHP warned that there are no complete workarounds for the vulnerabilities and that applying the security updates is the only safe solution.

The announcement is particularly relevant to organisations operating PHP-powered websites, web applications, APIs and server-side services.

Two critical vulnerabilities affect PHP request handling

The PHP advisory identifies two distinct flaws in how the runtime handles internal memory and request state. Both can create a path to remote code execution.

1. CVE-2026-109618: Remote code execution through out-of-memory corruption

This vulnerability involves PHP's handling of out-of-memory conditions.

According to PHP, an allocation failure can interrupt request processing while internal request data remains only partially initialised. During cleanup, PHP may incorrectly treat that data as valid, creating an opportunity for an attacker to trigger unsafe behaviour.

2. CVE-2026-109619: Remote code execution through stale global state

The second vulnerability concerns internal state that belongs to a request but can remain accessible after its associated memory has been freed.

A subsequent request processed by the same worker may encounter this stale state before normal initialisation resets it. Under vulnerable conditions, this can lead to remote code execution.

PHP published links to the individual security advisories for both CVEs alongside its release announcement.

Which PHP versions are affected?

PHP published fixed releases for four branches on 21 October 2026. Administrators should compare their installed versions with the following list.

PHP states that installations serving web requests are potentially affected. The advisory specifically mentions PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The security team identifies Apache mod_php as a particularly concerning configuration because a demonstrated exploit could trigger the attack through an unauthenticated request before application code runs.

PHP 8.1 and older no longer receive updates directly from the PHP project. Some Linux distributions and long-term support vendors may provide backported fixes, so administrators using these versions should check their vendor's security guidance.

What should administrators do now?

PHP recommends updating to a fixed release as soon as possible. The company states that temporary mitigations are not a complete substitute for applying the security update.

Recommended response steps include:

1. Inventory PHP installations. Identify all web-facing servers, application containers, hosting environments and PHP versions in use.

2. Prioritise internet-facing systems. Review exposed PHP services first, particularly installations using Apache mod_php.

3. Install the appropriate security release. Upgrade to the fixed version for the relevant supported branch, or apply a verified vendor-provided backport.

4. Restart affected workers where required. PHP's documented temporary mitigations include configuration changes that require worker restarts.

5. Verify the update. Confirm the running PHP version and check that the intended packages or source changes have been applied.

6. Review legacy deployments. Establish whether unsupported PHP installations can be upgraded or receive a verified security fix through their distribution or vendor.

Temporary mitigations are not a replacement for patching

PHP also documents measures that may reduce exposure to specific attack paths when an immediate update is not possible.

These include changes to memory handling and request-size limits for CVE-2026-109618, as well as disabling session upload progress and certain fatal-error backtrace behaviour for CVE-2026-109619.

However, the advisory explicitly warns that these measures do not make a vulnerable installation safe. Some mitigations block only confirmed paths rather than every possible route through the vulnerabilities. Administrators should follow the official advisory and avoid treating configuration changes as a permanent fix.

Why this matters for organisations

PHP remains an important server-side technology for websites and web applications. Vulnerabilities that can be triggered without authentication deserve urgent attention because an attacker may not need valid application credentials before attempting exploitation.

For organisations, the announcement highlights the importance of maintaining an accurate software inventory, monitoring security advisories and applying runtime updates across all deployment environments.

A patching process should also account for systems that are not directly managed by application developers, including hosting platforms, containers and legacy applications. A fix applied to one environment does not establish that every production instance has been updated.

These are operational implications of the disclosed vulnerabilities, rather than claims that every vulnerable installation has been compromised.

Conclusion

PHP's 21 October security announcement addresses two critical vulnerabilities that could enable unauthenticated remote code execution. The affected release branches have received fixes, and the PHP team recommends immediate updates.

Organisations should identify affected deployments, apply the appropriate security releases or verified vendor backports, and confirm that production systems are running the corrected versions. Temporary mitigations may help reduce exposure in specific circumstances, but PHP does not consider them a complete solution.