Skip to content
Critical PHP Vulnerabilities Enable Remote Code Execution Attacks

Critical PHP Vulnerabilities Enable Remote Code Execution Attacks

First seen 22 Oct 2026, 05:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 10:12 UTC
  • •CVE-2026-109618 and CVE-2026-109619 allow unauthenticated RCE with a CVSS score of 9.2.
  • •Public PoC exploits have emerged, leading to confirmed exploitation attempts in the wild.
  • •Immediate patching to PHP versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 is critical for all affected systems.

Two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, with a CVSS score of 9.2. These vulnerabilities allow unauthenticated remote code execution (RCE) through memory corruption during out-of-memory handling and stale global state retention. Affected systems include PHP-FPM, Apache with mod_php, and php-cgi, impacting numerous web applications like WordPress and Drupal. Following the disclosure, public proof-of-concept (PoC) exploits emerged, leading to active exploitation attempts. PHP released patches on October 21, 2026, and organizations are urged to update immediately to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12. The risk is particularly high for mod_php environments, where exploitation can occur before application code execution. Security teams are advised to monitor for unusual activity and ensure their PHP installations are updated.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2019-09-24
Public exploit for CVE-2019-11043 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-06-07
Public exploit for CVE-2024-4577 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-20
Vulnerability details leaked
Details of two critical PHP vulnerabilities leaked online, prompting PHP to accelerate its patch release.
Picussecurity
2026-10-21
PHP releases emergency patches
PHP released patches for CVE-2026-109618 and CVE-2026-109619, addressing critical RCE vulnerabilities.
Cisecurity
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
Exploitation confirmed in the wild
Security firms reported active exploitation attempts targeting the newly disclosed PHP vulnerabilities.
Blog.Sucuri

More articles in this cluster (32)

Following this threat?

Track LiteSpeed and CVE-2019-11043 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (29)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are vulnerable.
Is there confirmed exploitation of these vulnerabilities?
Yes, security firms have reported active exploitation attempts targeting these vulnerabilities.
What should organizations do immediately?
Organizations must update their PHP installations to the latest patched versions to mitigate the vulnerabilities.