Vulnerability Description
On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The PHP security advisory says both “can allow unauthenticated remote code execution” and that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
CVE-2026-109618: “RCE via OOM corruption”
According to the PHP advisory, “PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state.” The PHP project describes several ways a request can drive PHP to that out-of-memory point during multipart body parsing while staying within its configured limits. On Apache mod_php this happens before any application code runs.
CVE-2026-109619: “RCE via stale global state”
According to the PHP advisory, “PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request.” Some operations that run before the next request is initialized can then use that stale state after its memory has been freed, a use-after-free (CWE-416) vulnerability. Exploitation needs one request that leaves the stale state behind and a later request handled by the same worker that consumes it.
Confirmation
The PHP project has confirmed working attacks for each flaw on different server setups.
For CVE-2026-109618, it validated full remote code execution against Apache mod_php with default PHP input and memory limits. It considers FrankenPHP likely susceptible and PHP-FPM susceptible from source analysis, without a demonstrated exploit, and describes exploits against LSAPI as “likely but unvalidated.”
For CVE-2026-109619, it confirmed remote code execution against mod_php on PHP 8.5 with the fatal_error_backtraces setting enabled, and against both mod_php and PHP-FPM through the session upload progress feature, which is enabled by default. The PHP-FPM case, according to PHP, “depends on a suitable application operation.”
Impact
According to the PHP project, the confirmed impact of both flaws is unauthenticated remote code execution with the privileges of the web server’s PHP worker account. That account can typically read the application’s source, configuration files, and stored credentials such as database passwords and API keys, so the exposure extends to the databases and services those credentials reach. PHP states that updating is the only complete fix, and that the configuration measures it lists only reduce exposure to specific attack paths. A PHP host that was reachable from the internet while unpatched warrants a review for signs of compromise in addition to the upgrade, and its stored credentials should be rotated if any sign is found.
Details
| CVE ID | CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2, critical, per the PHP project |
| Date of Disclosure | PHP advance notice: October 20, 2026. PHP release: October 21, 2026. NVD: not yet published |
| Affected Assets | PHP serving web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed |
| Vulnerable Software Versions | PHP before 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and earlier get no official release; PHP published source backports for 7.4, 8.0, and 8.1 |
| PoC Available | VulnCheck lists multiple unverified public proof-of-concept repositories for CVE-2026-109618 as of October 21, 2026 |
| Exploitation Status | No exploitation reported by the PHP project as of October 21, 2026 |
| Patch Status | Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026 |
Censys ARC Perspective
Censys observes 2,580,515 hosts and 54,888,147 web properties running PHP. Of the 1,577,394 hosts that report a PHP version, 1,575,688 report a version older than the fixed releases. About 1.15 million report a branch the PHP project no longer supports, 8.1 or earlier, which gets no official release. Those hosts depend on a Linux distribution or long-term support vendor backport, or on PHP’s minimal source backports for 7.4, 8.0, and 8.1.
Two things limit what a version can tell you here. Linux distributions often backport security fixes without changing the PHP version string, so a host reporting an affected version may already be fixed, and our version-scoped counts are an upper bound. A version also does not show which server API a host runs, and PHP rates the risk highest for Apache mod_php. Figures cover internet-reachable hosts only, as of October 21, 2026.
Censys Queries
Platform: Found: 2,580,515 hosts and 54,888,147 web properties
host.services.software: (vendor="php" and product="php") or web.software: (vendor="php" and product="php")
ASM:
host.services.software.product="PHP" or web_entity.instances.software.product="PHP"