Skip to content
PHP Issues Emergency Patches for Critical RCE Vulnerabilities

PHP Issues Emergency Patches for Critical RCE Vulnerabilities

First seen 22 Oct 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 17:14 UTC
  • •PHP released critical patches for CVE-2026-109618 and CVE-2026-109619 with CVSS 9.2.
  • •Exploitation attempts have been confirmed, particularly against PHP-FPM and mod_php.
  • •Millions of installations, especially legacy versions, remain vulnerable and should be updated immediately.

PHP has released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2. These vulnerabilities affect PHP versions 8.5.11 and earlier, allowing unauthenticated attackers to execute arbitrary code. Exploitation attempts have already been observed, prompting PHP to urge immediate updates. The vulnerabilities stem from improper memory handling during out-of-memory conditions and use-after-free errors in session handling. Millions of PHP installations, particularly those running unsupported versions, are at risk. Users are advised to upgrade to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risks. Cloudflare has reported early attacks exploiting these flaws, raising concerns about widespread exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
CVE-2026-109619, a critical use-after-free vulnerability, was published with a CVSS score of 9.2.
Sploitus
2026-10-21
CVE-2026-109618 published
CVE-2026-109618, a critical out-of-memory handling vulnerability, was published with a CVSS score of 9.2.
Sploitus
2026-10-22
Emergency patches released
PHP released patches for both vulnerabilities, urging users to update to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
Techradar
2026-10-22
Exploitation attempts observed
Cloudflare reported early exploitation attempts targeting the newly disclosed vulnerabilities.
Techradar

More articles in this cluster (12)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4

Common questions

Which PHP versions are affected?
PHP versions 8.5.11 and earlier are affected by CVE-2026-109618 and CVE-2026-109619.
Is there confirmed exploitation of these vulnerabilities?
Yes, early exploitation attempts have been reported by Cloudflare shortly after the vulnerabilities were disclosed.
What should I do to protect my systems?
Immediately update to PHP versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to mitigate the risks.