ON 21 October 2026, PHP released fixes for two unauthenticated remote code execution (RCE) flaws: CVE-2026-109618 and CVE-2026-109619. The patches appear in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and enable RCE from the web worker account, with the advisories emphasising that exploitation can occur before any application code runs. PHP notes that updates are the primary mitigation and urges admins to upgrade promptly.
CVE-2026-109618 stems from memory corruption after an out-of-memory event. The PHP advisory explains that when PHP cannot allocate memory, it may exit the current task and leave request memory in an invalid state, after which the cleanup logic can act on corrupted memory. Attackers can trigger this with crafted multipart requests that stay within normal size limits, and this occurs entirely before application code executes, notably on Apache mod_php.
CVE-2026-109619 involves a use-after-free caused by stale global state across requests. Exploitation requires two linked requests handled by the same worker, with one leaving stale data behind and the next using it. PHP confirms two exploit paths: one in PHP 8.5 fatal error backtraces and another in session upload progress.
Affected setups include Apache mod_php (confirmed RCE for both flaws with default limits) and PHP-FPM (confirmed for the session upload progress path; the 109618 path is described as susceptible but not fully demonstrated). FrakenPHP and LSAPI are considered likely or conditional. Early activity was reported by Cloudflare, but there is no confirmed broad wildfire exploitation in the advisory, and CISA KEV lists no entries yet. Patch guidance is definitive: upgrade to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart all PHP workers.