Isolate Unpatched PHP Servers Now: Critical Remote Code Execution Flaws CVE-2026-109618 and 109619 Patched

Attackers can achieve full remote code execution on vulnerable PHP servers without any prior authentication, according to CERT-EU. This capability allows unauthorized actors to run arbitrary commands on the host system, potentially leading to complete server compromise. The European Union Agency for Cybersecurity warned that the ease of exploitation makes immediate action essential for any organization running PHP-based web applications.

The PHP Foundation released patches for these critical flaws on 21 October 2026 at 13:30 UTC. The update addresses CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the Common Vulnerability Scoring System. CERT-EU stated that initial proofs of concept have already circulated, raising the likelihood that attackers are actively exploiting these weaknesses in the wild.

Context and Background

The vulnerabilities affect the core memory management and state handling mechanisms of the PHP engine. CVE-2026-109618 involves memory corruption during out-of-memory error handling, while CVE-2026-109619 stems from stale global state persisting after a request ends. Both flaws allow attackers to bypass application-level security controls entirely, executing code before any application logic runs.

Affected Systems

Every PHP installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. CERT-EU identified mod_php as the highest-risk configuration. Many commercial and open-source products using PHP as a backend are also vulnerable. Organizations should consult the NCSC-NL GitHub repository to identify embedded third-party software that may be impacted by these underlying engine flaws.

What to watch

Users of the rpms.remirepo.net volunteer repository should note that updates will not be available on release day. The PHP team urges these users to switch to official distribution packages or build from source. For end-of-life versions like PHP 8.1, 8.0, and 7.4, the security team has published minimal source backports. Organizations should contact their Linux distribution or LTS vendor for pre-built packages if available.

What made it possible

Remote code execution vulnerabilities typically arise from how software manages memory or application state. Attackers exploit these weaknesses by sending crafted requests that corrupt internal data structures or leave residual state from previous operations. This allows malicious code to run in the context of the server process. Teams usually monitor for unusual memory usage or unexpected process behavior. Check whether your logging captures detailed request metadata to identify suspicious patterns before a full compromise occurs.

What to do and how to stay safe: PHP

• Apply the latest PHP updates to all supported versions immediately.
• Isolate internet-facing applications from public networks if patching is delayed.
• Verify that no application settings override security configurations.
• Monitor server logs for signs of unauthorized command execution.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are patched?

Patches are available for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Are older PHP versions supported?

No, PHP 8.1 and older are end-of-life, but minimal source backports are available for 7.4, 8.0, and 8.1.

What is the severity of these flaws?

Both CVE-2026-109618 and CVE-2026-109619 have a CVSS score of 9.2, classified as critical.