NCSC issues warning over critical PHP remote code execution vulnerabilities

The UK’s National Cyber Security Centre (NCSC) has released an urgent security advisory urging all UK organisations to take immediate action against two critical vulnerabilities affecting PHP (CVE-2026-109618 and CVE-2026-109619)

The security flaws permit unauthenticated remote code execution (RCE) on web servers, potentially allowing malicious actors to compromise underlying backend systems and web applications.

Vulnerability mechanics and technical impact

PHP is a widely deployed server-side scripting language used to generate dynamic web content, manage backend application logic, and interface with databases across public and enterprise networks.

The newly identified vulnerabilities stem from improper memory management during out-of-memory (OOM) conditions, leading to memory corruption:

CVE-2026-109618 (Partial Request Initialisation): An out-of-memory condition interrupts PHP processing while internal request data is only partially initialised. During the subsequent request cleanup process, the runtime incorrectly treats invalid data structures as valid, triggering memory corruption.

An out-of-memory condition interrupts PHP processing while internal request data is only partially initialised. During the subsequent request cleanup process, the runtime incorrectly treats invalid data structures as valid, triggering memory corruption.

CVE-2026-109619 (Stale State Reuse): Request-owned internal state persists after its underlying backing memory has been freed. A subsequent request handled by the same worker process can access this dangling state prior to re-initialisation, opening vector paths for heap manipulation and remote code execution.

Request-owned internal state persists after its underlying backing memory has been freed. A subsequent request handled by the same worker process can access this dangling state prior to re-initialisation, opening vector paths for heap manipulation and remote code execution.

Because these flaws target core runtime request handling, an unauthenticated attacker can remotely trigger memory corruption without prior access credentials.

NCSC recommended action plan for organisations

The NCSC strongly advises security operations teams and system administrators to prioritise internet-facing web assets and implement the following defensive steps:

Infrastructure discovery: Identify all internal and internet-facing systems hosting PHP runtimes. Given that all legacy and active PHP versions are potentially affected, asset discovery must encompass the entire enterprise estate.

Identify all internal and internet-facing systems hosting PHP runtimes. Given that all legacy and active PHP versions are potentially affected, asset discovery must encompass the entire enterprise estate.

Apply official patches: Upgrade all instances immediately to the latest patched PHP release branches. Organisations running unsupported or end-of-life (EOL) versions should migrate to supported, patched releases.

Upgrade all instances immediately to the latest patched PHP release branches. Organisations running unsupported or end-of-life (EOL) versions should migrate to supported, patched releases.

Deploy temporary mitigations or offline isolation: If immediate patching is not technically feasible, deploy temporary mitigation guidance issued by the PHP Foundation. If mitigations cannot be applied swiftly, isolate or take affected web servers offline until patches are deployed.

If immediate patching is not technically feasible, deploy temporary mitigation guidance issued by the PHP Foundation. If mitigations cannot be applied swiftly, isolate or take affected web servers offline until patches are deployed.

Compromise assessment: Prior to applying patches or bringing systems back online, audit targeted systems for signs of post-exploitation activity or persistent backdoors. Organisations lacking internal threat-hunting capabilities should engage NCSC-assured Cyber Incident Response providers.

Prior to applying patches or bringing systems back online, audit targeted systems for signs of post-exploitation activity or persistent backdoors. Organisations lacking internal threat-hunting capabilities should engage NCSC-assured Cyber Incident Response providers.

Monitor third-party dependencies: Continuously audit vendor software, web appliances, and integrated services that bundle embedded PHP components, leveraging inventory lists provided by partners such as NCSC-NL to track supply chain exposure.

Continuously audit vendor software, web appliances, and integrated services that bundle embedded PHP components, leveraging inventory lists provided by partners such as NCSC-NL to track supply chain exposure.