12 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
Two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect PHP versions 8.2, 8.3, 8.4, and 8.5. Both vulnerabilities involve memory management flaws that can allow attackers to execute arbitrary code with the privileges of the PHP web worker.
CVE-2026-109618 results from memory corruption during out-of-memory error handling. An unauthenticated attacker can send crafted multipart requests that exhaust memory and trigger an invalid request state, potentially leading to remote code execution. Third parties have reported exploitation of this vulnerability.
CVE-2026-109619 is a use-after-free vulnerability involving global state retained between PHP requests. Under certain conditions, stale references to freed request memory can be exploited to execute arbitrary code. PHP's advisory does not report exploitation of this vulnerability in the wild.
PHP released fixed versions on October 21, 2026. Organizations should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, restart all PHP workers, and prioritize internet-facing systems. Updating is the only complete mitigation for both vulnerabilities.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Remote Code Execution via Out-of-Memory Corruption in PHP
Identifier: CVE-2026-109618
PoC or Exploitation: Exploitation has been reported by third parties.
CVSS Score: 9.2 (Critical, CVSS v4.0)
Update / Patch:
PHP released fixed versions on October 21, 2026. Updating is the only complete mitigation.
Affected versions include:
PHP 8.2 before 8.2.35
PHP 8.3 before 8.3.36
PHP 8.4 before 8.4.27
PHP 8.5 before 8.5.12
Fixed versions include:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
PHP Security Advisory GHSA-w8hw-w9fx-j79w:
Description:
CVE-2026-109618 is a memory corruption vulnerability in PHP's handling of out-of-memory errors. It can lead to remote code execution.
PHP aborts a request on an out-of-memory error by using longjmp(). In some contexts, request memory is reachable before it is fully initialized. If any allocation fails at that point, the request memory is left in an invalid state and request shutdown then reads or branches on it. The failed allocation does not need to be related to the invalid memory. An unauthenticated attacker can send crafted multipart requests that exhaust memory while staying within PHP's apparent limits. The confirmed impact is remote code execution as the web worker account.
Mitigation Recommendation:
Update PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 on every system that serves web requests. Prioritize internet-facing servers and Apache mod_php deployments. Restart all PHP workers after updating.
Identify every PHP installation in your environment, including those bundled with hosting control panels, appliances, and container images. Verify the installed version on each, and confirm that updated packages come from a vendor that has issued the fix.
Move systems running PHP 8.1 or earlier to a supported fixed branch. Where an upgrade is not possible, obtain a backported fix from your distribution or long-term support vendor.
Remote Code Execution via Stale Global State in PHP
Identifier: CVE-2026-109619
PoC or Exploitation:
PHP's advisory does not state that this vulnerability has been exploited in the wild.
CVSS Score: 9.2 (Critical, CVSS v4.0)
Update / Patch:
PHP released fixed versions on October 21, 2026. PHP states that updating to a release with the complete state reset patch is the only reliable mitigation. No generic configuration change fully mitigates this vulnerability.
Affected versions include:
- PHP 8.2 before 8.2.35
- PHP 8.3 before 8.3.36
- PHP 8.4 before 8.4.27
- PHP 8.5 before 8.5.12
PHP 8.1 and earlier are no longer supported, and the project has not listed fixed releases for them. Some Linux distributions and long-term support vendors provide backported fixes. Check your vendor's advisories.
Fixed versions include:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
PHP Security Advisory GHSA-6wmf-4rv5-p3rp:
Description:
CVE-2026-109619 is a use-after-free vulnerability in how PHP handles global state between requests. It can lead to remote code execution.
PHP workers keep global state, such as error, session, object, and extension state. That state can point to memory owned by a single request. If it is not reset before the request memory is freed, a later operation can use it before normal request initialization. A crafted heap layout can then produce remote code execution with the web worker's privileges.
Mitigation Recommendation:
Update PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 on every system that serves web requests. Prioritize internet-facing servers and Apache mod_php deployments. Restart all PHP workers after updating.
Identify every PHP installation in your environment.
Move systems running PHP 8.1 or earlier to a supported fixed branch. Where an upgrade is not possible, obtain a backported fix from your distribution or long-term support vendor.
Apply PHP's interim measures on systems that cannot be updated immediately. Disable session upload progress, and on PHP 8.5 disable fatal error backtraces.
