UNIT 42 reports two critical remote code execution vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. CVE-2026-109618 arises from handling out-of-memory errors via longjmp(), which leaves request memory uninitialised due to improper control flow, enabling reliable RCE when OOM conditions are triggered.
CVE-2026-109619 involves longjmp() fatal error handling, where global memory can point to freed regions that may be read or branched on during subsequent requests, allowing arbitrary code execution. The evidence cited includes proof of concept exploits and telemetry indicating a large exposed surface, with Cortex Xpanse identifying over 22.6 million potentially vulnerable instances at the time of reporting.
The article notes that PHP is widely used across web servers and content management systems, emphasising the urgency to assess exposure and patch promptly in line with the PHP Group’s advisory. It also outlines protections available to Palo Alto Networks customers, including Cortex XDR, XSIAM, Cortex Xpanse, and Advanced Threat Prevention Plus with Frontier Virtual Patching.
Practical response guidance highlighted by Unit 42 includes scoping exposed PHP deployments, applying available patches, and leveraging the described product protections to identify and defend against post-exploitation activity. The piece references additional resources such as Unit 42 Threat Intel Services and the Unit 42 Incident Response team for help with compromises or proactive risk reduction, and provides regional contact numbers for urgent assistance.