Critical PHP RCE Vulnerabilities (CVE-2026-109618, CVE-2026-109619) — Update Now

Two critical security vulnerabilities in PHP have been addressed in new security releases, and website owners, hosting providers, and developers should prioritize updating their PHP installations immediately.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can potentially allow unauthenticated attackers to execute code remotely on vulnerable servers. The PHP security team has released patched versions and strongly recommends that users upgrade without delay. Both vulnerabilities have been rated CVSS 4.0 at 9.2, according to the PHP team's advance notice and security release information.

For businesses running PHP-powered websites, applications, APIs, and WordPress installations, this is a security issue that should not be ignored.

At Logicanvas.io, we believe proactive security maintenance is essential to protecting websites, applications, and the systems that power modern businesses.

What Are the Newly Discovered PHP Vulnerabilities?

The PHP security releases address two separate flaws involving internal memory management and request-processing state. Both can potentially expose web servers to remote code execution (RCE).

Remote code execution is particularly dangerous because a successful attack may allow an attacker to execute commands or code within the privileges of the affected PHP process.

1. CVE-2026-109618: Remote Code Execution Through Out-of-Memory Corruption

Security advisory: GHSA-w8hw-w9fx-j79w

This vulnerability involves PHP's handling of out-of-memory (OOM) conditions.

Under certain circumstances, PHP may encounter a memory allocation failure while internal request data is only partially initialized. During subsequent cleanup, PHP may incorrectly treat this incomplete data as valid.

This can create an opportunity for memory corruption and potentially lead to remote code execution.

The risk is especially concerning because the attack may occur during request processing, before an application has an opportunity to execute its own security checks.

The PHP security team identifies Apache configurations using mod_php as particularly high risk, with a demonstrated exploit involving an unauthenticated request.

Why this matters: Application-level authentication, permission checks, and input validation may not protect against a vulnerability triggered inside PHP before application code runs.

2. CVE-2026-109619: Remote Code Execution Through Stale Global State

Security advisory: GHSA-6wmf-4rv5-p3rp

The second vulnerability involves internal request state that may remain accessible after the memory backing that state has been freed.

A later request handled by the same worker may then encounter and use this stale state before PHP's normal initialization process resets it.

Depending on the execution path, this unsafe memory access may create conditions that lead to remote code execution.

The issue is particularly relevant to environments where PHP workers handle multiple requests over their lifetime.

The PHP security team has identified specific attack paths involving session upload progress and fatal-error backtraces. However, disabling those features only blocks confirmed paths; it does not eliminate every potential variant of the vulnerability.

Why this matters: A request that appears harmless in isolation could interact with internal state left behind by an earlier request handled by the same worker.

Which PHP Versions Are Affected?

The PHP security team has released patched versions for the following branches:

PHP branch	Patched version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

If your server runs an earlier release in one of these branches, upgrade to the corresponding patched version or a later release containing the fixes.

Official downloads and installation instructions are available on the PHP downloads page.

PHP 8.1 and older versions no longer receive regular security fixes directly from the PHP project. Some Linux distributions and long-term support vendors may provide backported patches, so administrators should verify their vendor's security advisories before determining whether their installed packages are protected.

Who Is at Risk?

The security issue affects PHP installations that serve web requests. The PHP team identifies several relevant deployment environments:

Apache with mod_php: Considered the highest-risk configuration because of a demonstrated unauthenticated attack path.
PHP-FPM: Commonly used with Nginx and Apache to process PHP requests.
php-cgi: PHP deployments using the CGI interface.
FrankenPHP: Applications using the FrankenPHP server.
LiteSpeed: Web hosting environments running PHP through LiteSpeed-supported configurations.

The exact exposure depends on the PHP version, deployment configuration, request-processing behavior, and available mitigations.

Website owners should not assume they are safe simply because they use a particular web server, framework, content management system, or hosting provider.

If PHP processes requests from the internet, verify the installed version and applicable vendor patches.

How to Protect Your Website and Server

Step 1: Upgrade PHP Immediately

The most important action is to install a patched PHP release.

Start by identifying the PHP version used by your website and the PHP version used by its actual request-processing service.

For a command-line installation, run:

php -v

Keep in mind that the command-line PHP binary may differ from the version used by PHP-FPM or Apache. Check your web server's active PHP configuration as well.

On Debian or Ubuntu systems, you can inspect installed PHP packages with:

dpkg -l | grep -E 'php[0-9.]'

On RHEL-based systems, you can inspect installed packages with:

rpm -qa | grep '^php'

These commands help identify installed packages but do not, by themselves, establish that a running web service has been patched.

Use your operating system or hosting provider's supported update mechanism. If you compile PHP from source, obtain a patched source release and follow the appropriate build and deployment procedure.

After upgrading:

Restart or reload the relevant PHP services as required by your deployment.
Confirm that the running PHP workers use the patched build.
Check every relevant PHP version, pool, container, and server.
Test critical website functionality, including uploads, sessions, APIs, and background processing.

Important: Updating the command-line PHP binary alone may leave a website vulnerable if its web-facing PHP runtime remains outdated.

Step 2: Apply Temporary Risk-Reduction Measures if Updating Is Delayed

An immediate upgrade is the recommended solution. If a patch cannot be deployed right away, the PHP security guidance describes several measures that may reduce exposure to particular attack paths.

These measures are temporary safeguards, not substitutes for installing the security fixes.

Reduce exposure to out-of-memory corruption

PHP administrators can consider the following measures:

Configure memory_limit=-1 at an appropriate administrative level, such as an FPM pool or Apache configuration, after evaluating the operational risks.
Ensure applications and lower-level configurations do not reintroduce a finite PHP memory limit.
Set a conservative post_max_size based on application requirements. The PHP advisory suggests 8M for applications that do not need file uploads and 32M where uploads are necessary.
Keep upload_max_filesize below post_max_size.
Enforce request-size, multipart-part, input-field, header-count, and nesting-depth limits at the web server or reverse proxy where appropriate.
Use container or cgroup resource limits as an availability boundary, with an appropriate policy for terminating affected workers.

Disabling PHP's memory limit can have resource-consumption implications, so administrators should assess their environment and establish suitable infrastructure-level resource controls.

The PHP team specifically warns against substituting RLIMIT_AS or RLIMIT_DATA for these safeguards, because such limits can trigger the vulnerable allocation-failure path.

Reduce exposure to stale global state

The PHP team also recommends several temporary configuration changes for the second vulnerability:

Set session.upload_progress.enabled=0 before request parsing and restart all relevant workers.
On PHP 8.5, set fatal_error_backtraces=0 and restart all relevant workers.
Review deprecated or invalid configuration directives that might generate diagnostics before initialization.
Investigate and correct attacker-reachable fatal errors and execution timeouts, including those associated with callbacks, uploads, imports, and cleanup operations.

These changes block or reduce exposure to particular confirmed attack paths. They do not guarantee that an installation is secure.

Avoid relying on application-level ini_set() calls or .user.ini files for settings that must take effect before request parsing. Likewise, hiding diagnostics through error_reporting, display_errors, or the @ operator does not resolve the underlying issue.

Step 3: Review Your Hosting Environment

If you use managed hosting, a VPS, a dedicated server, or a cloud platform, contact your provider to confirm whether the relevant PHP packages have been patched.

Linux distributions and long-term support vendors may distribute security fixes through their own package repositories, including backported patches that do not necessarily change the upstream PHP version number to the versions listed above.

Ask your hosting provider to confirm:

Which PHP runtime handles public web requests.
Whether the relevant security patches have been installed.
Whether all PHP-FPM pools, containers, and web-facing workers are updated.
Whether the necessary worker restarts or service reloads have been completed.

If you manage multiple websites, check each environment rather than assuming a server-wide change covers every installation.

Step 4: Review Logs and Investigate Suspicious Activity

A security patch prevents exploitation of the corrected vulnerabilities, but it does not establish whether an earlier compromise occurred.

If your server was running a vulnerable version, consider reviewing:

Web server access and error logs.
PHP-FPM and application logs.
Unexpected file changes and newly created executable files.
Unusual outbound connections or unexplained resource consumption.
Changes to scheduled tasks, application accounts, and server configuration.

Preserve relevant logs before making substantial changes. If you identify evidence of compromise, follow your incident-response process, isolate affected systems when appropriate, and investigate credentials and secrets that may have been exposed.

Do not assume that the absence of obvious errors means an attack did not occur.

What About WordPress Websites?

WordPress runs on PHP, so WordPress site owners should pay attention to this security advisory.

The vulnerabilities are in the PHP runtime rather than a specific WordPress plugin or theme. Updating WordPress core or installing a security plugin does not, by itself, patch an affected PHP installation.

If you operate a WordPress website:

Check the PHP version used by the hosting environment.
Ask your hosting provider to confirm that the runtime has received the relevant fixes.
Verify that the active web-facing PHP service is running the patched build.
Back up your website and database according to your normal change-management procedure.
Test your site's login, forms, uploads, checkout, integrations, and other critical features after updating.

Keep WordPress core, themes, and plugins updated as part of your broader security strategy. However, do not treat those updates as replacements for the PHP runtime patch.

Why These Vulnerabilities Deserve Immediate Attention

Remote code execution vulnerabilities can have consequences beyond an individual website.

Depending on the permissions and isolation of the affected process, a successful exploit may enable an attacker to modify application files, access data available to the PHP process, interfere with website operations, or establish a foothold for further investigation and attacks.

The actual impact depends on the server's permissions, configuration, isolation controls, and the attacker's capabilities.

Because the PHP team has identified an unauthenticated attack path, administrators should prioritize remediation rather than waiting for an application-specific security issue or visible evidence of exploitation.

Security controls such as a web application firewall, strict file permissions, network restrictions, and container isolation remain valuable defense-in-depth measures. They do not replace the PHP security update.

Final Checklist for Website Owners and Developers

Use this checklist to track your remediation work:

Identify every PHP runtime that serves web requests.
Upgrade to a patched PHP release or a verified vendor package containing the fixes.
Restart or reload the relevant services and workers.
Verify the PHP version and patch status of the running web-facing runtime.
Review temporary mitigation settings if an immediate upgrade is not possible.
Check logs for signs of suspicious activity.
Test critical application functionality after deployment.
Document the changes and schedule follow-up security reviews.

Final Thoughts from Logicanvas.io

The latest PHP security releases are an important reminder that application security extends beyond the code developers write. The language runtime, server configuration, hosting environment, and operational practices all play a role in protecting a website.

If your website uses PHP, verify your runtime and apply the appropriate security update as soon as possible. Temporary configuration changes can reduce exposure to certain attack paths, but a patched runtime is the essential long-term solution.

At Logicanvas.io, we encourage developers, website owners, and system administrators to make security maintenance a routine part of running reliable web applications.

Stay updated, validate your deployments, and treat critical security advisories as actionable maintenance—not something to postpone until a problem appears.

Official resources:

Disclaimer: This article is intended for informational purposes and does not replace a security assessment of your specific environment. Follow official PHP and operating-system vendor guidance when applying security updates.