PHP RCE Alert: CVE-2026-109618 & CVE-2026-109619

PHP security update: two critical vulnerabilities

On October 21, 2026, the PHP project published security advisories for CVE-2026-109618 and CVE-2026-109619. Both describe memory-safety issues that can lead to remote code execution (RCE) in affected configurations. Successful exploitation could let an attacker run code with the privileges of the PHP worker, potentially exposing application data and credentials or enabling further compromise.

The advisories describe different underlying problems and deployment-specific conditions. Do not assume every PHP deployment is equally exposed, but treat any affected, internet-facing runtime as a priority. The complete fix is to deploy a PHP release that includes the upstream patches.

Status checked October 22, 2026. Confirm current package availability and vendor guidance before making production changes; operating-system and hosting vendors may publish patched packages on a different schedule.

What the advisories say

CVE-2026-109618: out-of-memory handling

PHP’s advisory for CVE-2026-109618 explains that an out-of-memory condition can interrupt request processing while request memory is only partly initialized. In affected paths, request shutdown may then inspect invalid state. The advisory confirms unauthenticated RCE over HTTP against Apache mod_php; it also describes potential exposure in other SAPIs, with exploitability depending on the runtime, application, extensions, and request path.

The patch changes how PHP handles out-of-memory conditions. This is an engine-level issue: a WAF, rate limit, or application-level input check is not a substitute for updating PHP.

CVE-2026-109619: request state retained between requests

PHP’s advisory for CVE-2026-109619 describes request-owned state that can remain referenced by a worker after the request ends. A later operation, sometimes in a subsequent request handled by the same worker, may use that stale state before normal initialization resets it.

The advisory documents confirmed cases and conditions that vary by SAPI, PHP version, configuration, application, and extensions. It does not mean that every PHP-FPM or Apache installation has the same exposure or exploitation reliability. It does mean that configuration review alone cannot establish that an affected runtime is safe.

Affected releases and fixed versions

The upstream fixes are included in these releases:

Versions earlier than the listed release in each branch are affected. These advisories do not provide upstream fixes for end-of-life branches such as PHP 8.1, 8.0, or 7.x. Move those workloads to a supported, patched branch; if that cannot happen immediately, reduce exposure while planning the migration.

Check the relevant PHP advisory and your operating-system, container-image, or hosting-provider security notice. Some vendors backport security fixes without changing the upstream version number, so compare the vendor’s package revision and advisory status rather than relying on the PHP version string alone.

What to do now

1. Inventory every PHP runtime. Include Apache mod_php, PHP-FPM pools, containers, CI runners, scheduled jobs, bundled appliance runtimes, and managed hosting environments. Check each deployed runtime, not just the PHP CLI on an administrator’s workstation.
2. Upgrade using a trusted vendor source. Install the fixed release or a vendor package explicitly confirmed to contain the fixes. Test application compatibility and extensions, then roll out promptly.
3. Restart and verify all workers. A package update does not necessarily replace already-running PHP-FPM or web-server workers. Restart the appropriate services using your platform’s deployment procedure, then verify the package and the runtime actually serving requests.
4. Reduce public exposure if patching is delayed. Restrict access to the affected application or disable PHP request handling at the edge if your incident and availability requirements allow it. A maintenance response can reduce exposure, but it is not a patch and should not be described as a guaranteed security boundary.
5. Review for signs of compromise. Preserve relevant application, PHP, web-server, and infrastructure logs. Investigate unexpected PHP worker behavior, modified files, new processes, unusual outbound connections, and access to secrets. If compromise is plausible, follow your incident-response process, including credential rotation from a trusted environment.

Temporary mitigations: limited, not a fix

The PHP advisories describe configuration measures for specific paths, but none replaces an update:

• For CVE-2026-109618, PHP identifies administratively setting memory_limit=-1 as the primary configuration mitigation for a predictable per-request out-of-memory trigger. It is not complete protection: lower-level allocation failures can still reach the vulnerable path. It also removes PHP’s per-request memory cap, so assess the availability and resource-exhaustion consequences with your operations team before applying it.
• For CVE-2026-109619, the advisory describes disabling fatal_error_backtraces on PHP 8.5 and disabling session.upload_progress as ways to remove specific demonstrated state paths. These are narrow measures; they do not cover every producer/consumer path or application and extension combination.
• Keep request-body, multipart, input, and upload limits appropriately bounded, and block multipart requests at the frontend if the application does not need them. Such controls can reduce resource-exhaustion risk but do not close either vulnerability.
• Do not use RLIMIT_AS or RLIMIT_DATA as a workaround for CVE-2026-109618. The PHP advisory warns that these limits can cause allocation failures that reach the vulnerable path.

Avoid copying a generic server configuration into production without reviewing your TLS termination, load balancers, health checks, administrator access, and rollback procedure. Likewise, a clean log review or a WAF rule does not prove that a runtime is unaffected.

Check the runtime carefully

php -v reports the CLI binary. php-fpm -v reports the FPM executable, if present; neither alone proves which version or package is serving production traffic, or whether old workers are still running. Verify through your host or package manager, inspect the actual service and container image, and confirm the rollout after restarting workers. Avoid exposing a public phpinfo() page as a way to check a production server.

References

• PHP advisory: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)
• PHP advisory: CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)
• NVD: CVE-2026-109618
• NVD: CVE-2026-109619

Need help coordinating remediation?

ImpacttX Technologies can help teams inventory PHP workloads, plan version upgrades, validate deployments, and review infrastructure hardening. Use our Contact Us form or email us at [email protected] to discuss your environment and remediation needs.