PHP released fixes on 21 October 2026 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on CVSSv4. Both can enable unauthenticated remote code execution with the privileges of the web worker. The flaws affect PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Rapid7 says researchers developed working exploits, including against mod_php and PHP-FPM through different routes.
The advisories also report signs that others are reproducing the research and expect a usable exploit to become public; they do not say the flaws are being exploited in the wild.
CVE-2026-109618 involves memory corruption during out-of-memory handling: crafted multipart requests can exhaust memory and leave invalid data for request cleanup. Apache mod_php is considered particularly exposed because cleanup can run even if request startup fails, before application code executes. PHP-FPM terminates a worker on startup failure, preventing that particular attack sequence, although the advisory says other exposure may remain.
CVE-2026-109619 is a use-after-free involving state retained between requests handled by the same worker. The advisory confirms RCE paths involving mod_php and session upload progress, including a PHP-FPM route requiring particular application behaviour and successive requests to reach the same worker.
Rapid7 urges emergency patching. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; earlier releases in those branches are affected. PHP 8.1 and older no longer receive routine upstream updates, though limited backports are available for versions 7.4, 8.0 and 8.1. Configuration changes can reduce exposure to specific attack paths, but PHP says only an update containing both complete fixes is full remediation.