PHP Patches Critical RCE Vulnerabilities

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers.

Remote Code Execution (RCE)

Remote Code Execution (RCE) is a security flaw that allows an attacker to run arbitrary code on a remote system. Depending on the server's configuration and the attacker's level of access, successful exploitation could lead to unauthorized access, data theft, or server compromise.

Both vulnerabilities carry a CVSS v4.0 score of 9.2, (PHP security advisory) indicating a critical level of risk. They involve PHP's internal memory management and request-processing mechanisms, potentially allowing malicious requests to exploit weaknesses before application-level security controls can intervene.

Administrators should review the official PHP security advisory, identify affected installations, and apply the appropriate security updates promptly.

Which PHP Versions Are Affected?

The security fixes are available in the following releases:

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619 PHP 8.1 and older branches are also affected but no longer receive regular upstream security updates.

What Are the Vulnerabilities?

The first vulnerability, CVE-2026-109618, involves memory corruption during out-of-memory handling. Under certain conditions, PHP may attempt to process incompletely initialized internal data, potentially enabling remote code execution.

The second, CVE-2026-109619, involves stale global state that can reference memory after it has been freed. A subsequent request handled by the same worker may encounter this invalid state, potentially allowing an attacker to execute code.

PHP installations serving web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project identifies mod_php as a particularly high-risk configuration.

How to Verify Your PHP Configuration

Administrators should verify that the actual PHP runtime serving their applications is correctly configured and has received the latest applicable security updates.

1. Check the installed PHP version

For a host-based PHP installation, run:

$ php -v

This displays the PHP CLI version. Note that the CLI version may differ from the version used by PHP-FPM, Apache, or another web-serving runtime.

2. Inspect the loaded PHP configuration

Display the configuration files used by the PHP CLI:

$ php --ini

Check important configuration directives:

$ php -i | grep -E \
'^(PHP Version|Server API|session.upload_progress.enabled|session.serialize_handler)'

Review the output against the relevant PHP security advisory. A directive being enabled does not automatically indicate a vulnerability; applicability depends on the specific vulnerability, runtime version, configuration and deployment.

3. Check the web-serving PHP runtime

For PHP-FPM, identify the installed versions and running services:

$ systemctl list-units --all --type=service 'php*-fpm.service'

For Apache, check whether a PHP module is loaded:

$ sudo apachectl -M 2>/dev/null | grep -i php

For Docker, inspect the PHP runtime inside the relevant application container:

$ sudo docker exec <container_name> php -v

Replace <container_name> with the actual container name. If PHP is installed in a different container or managed by another service, inspect that runtime instead.

4. Review security-sensitive settings

Compare the effective configuration with the mitigation guidance for the specific CVE. If a setting must be changed, use a persistent configuration file or deployment configuration rather than an undocumented manual change that may disappear after a restart or container recreation.

Restart or reload the relevant service only when required, following the application's maintenance and availability procedures.

5. Verify the remediation

After applying a fix or mitigation:

• Confirm the actual runtime version and vendor security status.
• Verify the effective configuration of the web-serving runtime.
• Check that the application remains healthy.
• Confirm that configuration changes persist after service restarts or container recreation.
• Recheck applicable security advisories for any additional required fixes.

Important: If an immediate security update is unavailable, assess the exposure of affected internet-facing services and consider temporary isolation or other vendor-recommended mitigations. Do not assume a system is vulnerable solely because a particular configuration directive is enabled, or safe solely because the CLI reports a patched version.

For further details, consult the official PHP security advisory and the CERT-EU security alert.


We hope this was helpful.
Keep learning. Keep exploring. Stay secure.