Multiple Critical vulnerabilities in PHP that can lead to Remote Code Execution, Patch ...

Version: 1.0 Affected software: All PHP versions including PHP 5 Type: CWE-400 : Uncontrolled Resource Consumption CWE-755 : Improper Handling of Exceptional Conditions CVE/CVSS: CVE-2026-109618: 2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) CVE-2026-109619: 2 (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

Two critical remote code execution (RCE) vulnerabilities, tracked as CVE-2026-109618 and

CVE-2026-109619, have been reported in PHP, a widely used server-side programming language.

Successful exploitation may allow an unauthenticated remote attacker to execute arbitrary code on vulnerable systems by sending specially crafted HTTP POST requests. Depending on the server's configuration and the privileges of the affected process, exploitation could potentially result in unauthorized system access and the execution of operating system commands.

Given the reported severity, broad deployment of PHP, and potential for remote code execution, exploitation should be considered a credible and urgent risk.

CVE-2026-109618 (CVSS v4.0: 9.2) is a remote code execution vulnerability in PHP associated with improper handling of out-of-memory (OOM) conditions during request processing. Specifically crafted HTTP multipart/form-data requests may trigger a fatal memory error and subsequent memory corruption, potentially allowing a remote attacker to execute arbitrary code.

CVE-2026-109619 (CVSS v4.0: 9.2) is a remote code execution vulnerability in PHP caused by stale global state following a fatal error. Internal state may remain invalid or reference freed memory, allowing a subsequent request handled by the same worker to trigger memory corruption and potentially execute arbitrary code.

These vulnerabilities involve PHP's handling of memory exhaustion and fatal errors. When a request exceeds the configured memory_limit, PHP may encounter an out-of-memory (OOM) condition while internal request data is only partially initialized. Subsequent cleanup or error-handling routines may incorrectly process this invalid state, potentially resulting in memory corruption and remote code execution.

A related vulnerability occurs when request-specific global state persists after a fatal error, even though the memory it references has been freed. A subsequent request handled by the same worker may then access stale state before it is properly reinitialized, potentially enabling remote code execution.

Inventory all PHP installations, including those bundled with vendor appliances, Windows applications, and control panels such as cPanel and Plesk. Prioritize internet-facing systems and deployments using web-serving SAPIs.

NCSC-NL provides an overview of PHP-based applications that may be affected by these vulnerabilities to help identify potentially vulnerable systems at .

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing. Patches are available from the official PHP website. Linux distributions and long-term support (LTS) vendors received the fixes in advance, so check with your vendor for updated packages.

PHP 8.1 and earlier are no longer supported by the PHP project and do not receive upstream security updates. However, some Linux distributions and LTS vendors may provide backported security fixes. your vendor for further information, or upgrade to a currently supported PHP version.

PHP may be bundled with third-party software or firmware. In such cases, check with the relevant vendor for security updates and guidance on applying the necessary fixes.

Reduce your attack surface

If immediate patching is not possible, the Centre for Cybersecurity Belgium recommends considering taking vulnerable websites offline or restricting public access to affected internet-facing applications until the relevant security updates can be applied.

PHP emphasizes that applying the appropriate security update is the only complete solution. The recommended mitigation measures may reduce exposure to specific attack vectors but do not eliminate the underlying vulnerabilities or guarantee that an installation is secure.

Exercise caution when applying mitigation strategies found online that are not recommended by your software vendor, as they may disrupt functionality or cause deployment issues.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.