PHP Patches Critical RCE Vulnerabilities

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers.

Remote Code Execution (RCE)

Remote Code Execution (RCE) is a security flaw that allows an attacker to run arbitrary code on a remote system. Depending on the server's configuration and the attacker's level of access, successful exploitation could lead to unauthorized access, data theft, or server compromise.

Both vulnerabilities carry a CVSS v4.0 score of 9.2, (PHP security advisory) indicating a critical level of risk. They involve PHP's internal memory management and request-processing mechanisms, potentially allowing malicious requests to exploit weaknesses before application-level security controls can intervene.

Administrators should review the official PHP security advisory, identify affected installations, and apply the appropriate security updates promptly.

Which PHP Versions Are Affected?

The security fixes are available in the following releases:

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619 PHP 8.1 and older branches are also affected but no longer receive regular upstream security updates.

What Are the Vulnerabilities?

The first vulnerability, CVE-2026-109618, involves memory corruption during out-of-memory handling. Under certain conditions, PHP may attempt to process incompletely initialized internal data, potentially enabling remote code execution.

The second, CVE-2026-109619, involves stale global state that can reference memory after it has been freed. A subsequent request handled by the same worker may encounter this invalid state, potentially allowing an attacker to execute code.

PHP installations serving web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project identifies mod_php as a particularly high-risk configuration.

How to Protect Your Server

Administrators should identify their installed PHP versions and apply the appropriate security updates immediately.

Check the PHP CLI version:

$ php -v

On Debian or Ubuntu, update the package lists and install available upgrades:

$ sudo apt update
$ sudo apt upgrade

Then verify the installed version again:

$ php -v

Important: The CLI version may differ from the PHP runtime serving your website. Check PHP-FPM versions and web-server configuration as well. If you use a third-party repository, container image or manually compiled PHP installation, ensure the actual runtime has received the fix.

After upgrading, restart the relevant PHP-FPM service or web server if required, and verify that the application is running the patched version. If an immediate update is impossible, consider temporarily isolating affected internet-facing services until remediation is complete.

For further details, consult the official PHP security advisory and the CERT-EU security alert.

These PHP vulnerabilities demonstrate why prompt security patching is essential for internet-facing infrastructure. Administrators should verify every PHP runtime, install the appropriate fixed release, and confirm that affected services are running updated code. For unsupported PHP branches, plan a migration to a supported version rather than relying on an upstream fix that may never arrive.

We hope this was helpful.
Keep learning. Keep exploring. Stay secure.