SECURITY ALERT: PHP Critical RCE Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

The PHP Security Team has released advisories addressing two critical, interlinked vulnerabilities in PHP: CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state).

According to PHP, all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. They consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities allow an unauthenticated attacker with network access via HTTP to achieve remote code execution as the web worker account, potentially resulting in a complete system takeover with high impact to confidentiality, integrity, and availability.

PHP Security considers this a high-priority risk reduction measure and strongly recommends immediate action to address the identified exposure.

TrendAI also has a blog entry that has more detailed information on the issue itself: Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now

Affected 3rd Party Products

Vulnerability Details

Successful exploitation of either vulnerability can result in unauthenticated remote code execution as the web worker account. Both vulnerabilities carry high impact scores across all three pillars of the CIA triad:

Confidentiality: High — attacker may access all data processed by the PHP worker

Confidentiality: High — attacker may access all data processed by the PHP worker

Integrity: High — attacker may modify or destroy data and plant persistent backdoors

Integrity: High — attacker may modify or destroy data and plant persistent backdoors

Availability: High — attacker may disrupt system operations entirely

Availability: High — attacker may disrupt system operations entirely

PHP Security strongly recommends the following immediate action:

Update PHP to the patched release for your branch immediately: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (whichever matches your current 8.x series). The update is the only complete mitigation for both vulnerabilities.

Update PHP to the patched release for your branch immediately: 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (whichever matches your current 8.x series). The update is the only complete mitigation for both vulnerabilities.

For those on earlier versions of PHP ( Cyber Risk Overview > Exposure Overview.

TrendAI Vision One Threat Intelligence Hub

TrendAI has added information into the Vision One Threat Intelligence Hub that provides relevant background information including Tactics, Techniques and Procedures (TTPs), Risk Management Guidance, and Threat Hunting Queries.

TrendAI Vision One XDR Threat Investigation

Monitor workbenches for suspicious activity:

PHP based Command Execution Attack

PHP based Command Execution Attack

Possible Webshell Activity with Base64 Encoded Payload via PHP

Possible Webshell Activity with Base64 Encoded Payload via PHP

Web Shell Credential File Access via PHP CGI Process

Web Shell Credential File Access via PHP CGI Process

Potential Command Execution via PHP Webshell

Potential Command Execution via PHP Webshell

Shell Command Execution via PHP-FPM

Shell Command Execution via PHP-FPM

Detection Rules and Filters TrendAI Vision One Endpoint Security IPS Rules (including Server and Workload Security (SWP) and Deep Security)

Rule 1012749 – PHP Application Remote Code Execution Vulnerability

Rule 1012749 – PHP Application Remote Code Execution Vulnerability

TrendAI Vision One TippingPoint

Filter 48514 (Security Policy) – Sec Optimized enabled

Filter 48514 (Security Policy) – Sec Optimized enabled

TrendAI Vision One Network Detection and Response (formerly Deep Discovery Inspector (DDI))

Rule 6021 – CVE-2026-109618 - PHP Zend HashTable Remote Code Execution Exploit - HTTP (Request)

Rule 6021 – CVE-2026-109618 - PHP Zend HashTable Remote Code Execution Exploit - HTTP (Request)

TrendAI Impacted Products and Services

TrendAI has implemented an urgent assessment of existing TrendAI products and services that may be impacted by these vulnerabilities. More information will be shared in a separate article if any TrendAI products are affected and the necessary mitigation steps needed to address.