Critical PHP RCE Flaws: CVE-2026-109618 and 109619

Two critical vulnerabilities in the PHP runtime have prompted an emergency security response. Identified as CVE-2026-109618 and CVE-2026-109619, both are rated 9.2 under CVSS v4.0 and can lead to unauthenticated remote code execution under vulnerable conditions.

On 21 October 2026, PHP released security updates addressing both issues. The UK's National Cyber Security Centre (NCSC) has also urged organisations to identify affected PHP installations and apply the relevant fixes.

This matters beyond organisations running custom PHP applications. PHP is also used by content management systems, e-commerce platforms and other web-based services. A company may depend on a vulnerable runtime without managing PHP directly.

Understanding the two PHP vulnerabilities

Both vulnerabilities involve memory handling inside PHP rather than a weakness in a particular website's application code.

CVE-2026-109618 — Out-of-memory handling and memory corruption

PHP can encounter an out-of-memory condition while processing a request. Under vulnerable conditions, its error-handling process can interrupt execution before internal request data has been fully initialised.

Subsequent cleanup operations may treat invalid or partially initialised data as legitimate. This creates memory corruption that can potentially be exploited to execute attacker-controlled code.

CVE-2026-109619 — Stale internal state and use-after-free

The second vulnerability involves request-related internal state that remains accessible after its underlying memory has been released.

A later request handled by the same PHP worker may access that stale state before normal initialisation replaces it. This use-after-free condition can also lead to remote code execution.

The NCSC describes both weaknesses as potentially allowing attackers to execute commands on affected web servers. The precise exploitation conditions differ, so the two CVEs should be assessed separately rather than treated as interchangeable.

The significant operational concern is that the weaknesses exist within the PHP runtime. Fixing an individual WordPress plugin or application dependency does not necessarily correct a vulnerable PHP installation.

Which PHP versions are affected?

The PHP security releases published on 21 October 2026 address both vulnerabilities in the supported branches.

PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 and older	Check vendor backports or migrate to a supported branch

The fixed releases are confirmed in the published security reporting. Organisations using distribution-maintained packages should check their vendor's security notices because a fix may be backported without changing the upstream PHP version number.

Do not assume that a website is protected simply because its content management system or plugins are up to date. The PHP runtime is a separate component.

For shared hosting, the provider may control the installed PHP packages. For VPS, dedicated servers and self-managed containers, responsibility usually sits with the organisation or its contracted administrator.

Why these vulnerabilities matter to businesses

The primary concern is remote code execution. Successful exploitation could allow an attacker to execute code within the context of the affected PHP process.

The consequences depend on the privileges assigned to that process, the application's access to databases and files, and the separation between services.

A compromised web application could potentially expose sensitive application data or provide an attacker with a starting point for further activity. However, these are possible consequences, not evidence that every vulnerable server has been compromised.

The vulnerabilities are particularly relevant to businesses operating customer portals, e-commerce websites, booking systems, PHP-based internal applications or public-facing APIs.

There is also an inventory problem. A company may know which applications it uses without knowing which PHP runtime versions support them. Older vendor applications, forgotten development servers and container images can remain outside routine patching.

This is where website security and malware monitoring and a maintained software inventory serve different purposes. Monitoring may identify suspicious activity, but it cannot substitute for knowing which systems require a security update.

What people get wrong about these PHP vulnerabilities

The first mistake is treating the issue as a WordPress vulnerability. WordPress uses PHP, but these CVEs concern the underlying runtime. Updating WordPress alone does not establish that the PHP installation has been fixed.

The second mistake is assuming that a web application firewall makes patching unnecessary. A WAF can help filter suspicious requests and reduce exposure to certain attack patterns. It cannot reliably prevent every path to memory corruption inside PHP.

A web application firewall can therefore provide an additional protective layer, particularly during emergency maintenance. It should not be treated as a complete remedy.

The third mistake is upgrading PHP without testing application compatibility. Moving an older application to a newer PHP branch may expose deprecated functions, incompatible libraries or application errors.

That risk is real, but it needs to be managed through backups, compatibility testing and a planned rollback procedure. It does not justify leaving an internet-facing application vulnerable indefinitely.

The fourth mistake is checking the PHP version but not restarting the running processes. Depending on the installation method, PHP-FPM workers or Apache processes may need restarting before the updated runtime is actually in use.

Finally, the public discussion around exploitation needs careful interpretation. Research organisations have reported proof-of-concept activity and differing observations about exploitation. These reports do not establish that every exposed system has been attacked. The absence of a confirmed compromise is also not proof that a vulnerable installation is safe

What IT teams should do now, in order

First, identify every PHP installation. Check internet-facing web servers, VPS instances, shared hosting accounts, containers, development systems and applications that bundle PHP. Record the installed version, deployment method, responsible owner and whether the service is externally accessible.

For a self-managed Linux server, an initial check might be:

php -v

This reports the command-line PHP version. It does not necessarily identify the version used by Apache or PHP-FPM, so inspect the actual web-serving runtime and installed packages as well.

Second, establish patch availability. Compare the deployed runtime against the fixed releases or your operating system vendor's security advisory. For unsupported PHP branches, determine whether a maintained vendor backport is available or whether migration is required.

Third, prioritise internet-facing systems. Publicly accessible applications warrant urgent attention. Systems that cannot be patched promptly should be assessed for temporary restrictions, including limiting exposure where operationally possible.

The NCSC advises considering taking a system offline if the required updates or temporary protections cannot be applied in time.

Fourth, prepare for the change. Take a verified backup of application files, databases and relevant configuration. Test the PHP update in a staging environment where practical, paying attention to application compatibility and installed extensions.

Fifth, install the security update. Apply the fixed runtime or vendor-maintained package, restart the affected PHP processes and verify that the running service uses the corrected build.

For containerised applications, update the base image, rebuild the application image and redeploy the containers. Merely updating the host operating system may not update PHP inside a container.

Sixth, validate application functionality. Test authentication, database operations, file uploads, scheduled tasks, payment integrations and other critical functions. Review PHP, web server and application logs for unexpected errors.

Seventh, investigate suspicious activity. Where a vulnerable public-facing server has been exposed, examine available access logs, process activity, unexpected file modifications and other relevant indicators. Preserve evidence if compromise is suspected.

Finally, establish continuing ownership. Assign someone to track PHP security releases, review vendor notices and verify that updates reach production systems. This is an ongoing operational responsibility, not a one-off response to a headline.

For businesses using external support, server administration and patch management should include clear responsibilities for identifying affected systems, testing updates, deploying fixes and reporting exceptions.

These vulnerabilities illustrate a familiar operational problem. A business may already have security software, monitoring and backups, yet remain exposed because nobody has confirmed which PHP versions are running or who is responsible for updating them.

The lasting control is not simply installing this week's patches. It is maintaining an accurate inventory, applying supported updates and verifying that the corrected software is actually running.