🚨 Two Critical PHP Vulnerabilities Discovered — Update Now!
On October 21, the PHP team released emergency security updates addressing two critical vulnerabilities, both rated CVSS 9.2.
Both vulnerabilities could allow attackers to execute arbitrary code remotely (**RCE**) without authentication.
What's the issue?
🔴 CVE-2026-109618 — A flaw in out-of-memory (OOM) handling that can lead to memory corruption.
🔴 CVE-2026-109619 — A use-after-free vulnerability caused by stale global state persisting between HTTP requests.
These vulnerabilities affect several common PHP runtimes, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
The Apache mod_php scenario is particularly concerning, as exploitation may be possible before any application code even runs.
✅ Fixed versions:
• PHP 8.5 → 8.5.12
• PHP 8.4 → 8.4.27
• PHP 8.3 → 8.3.36
• PHP 8.2 → 8.2.35
PHP 8.1 and older versions are no longer officially supported, although patches may be available through OS vendors.
What should you do?
Check the PHP version running in production, including Docker containers and PHP-FPM environments.
⚠️ Temporary mitigations are not a complete fix. Upgrading to a patched PHP release is strongly recommended.
🔗 Official PHP Security Advisory
If you're running PHP in production, make this update a priority.