Bright Nexus

Published on October 22, 2026

Critical Vulnerabilities in PHP Require Immediate Patching

Severity

Critical

Detail

Two critical issues have been identified in PHP web runtimes (CVE-2026-109618 and CVE-2026-109619) that can allow an unauthenticated actor to run code on affected systems. A remote caller can send crafted web requests to affected PHP workers and execute arbitrary code, read process-accessible data, or cause denial of service.

This issue is accessible remotely by an actor without authentication over the internet-to-customer-application boundary, which can result in code execution, unintended access to process-accessible data, or denial of service on the targeted PHP worker. The issue is bounded to the affected worker and its application-level permissions; no cross-customer propagation has been established to date.

CVE IDSummaryCVSS Score
CVE-2026-109618involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.9.2 (Critical)
CVE-2026-109619describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.9.2 (Critical)

Affected Products

Affected versions:

  • PHP 8.5: Affected versions 8.5.0–8.5.11 · First fixed version: 8.5.12
  • PHP 8.4: Affected versions 8.4.0–8.4.26 · First fixed version: 8.4.27
  • PHP 8.3: Affected versions 8.3.0–8.3.35 · First fixed version: 8.3.36
  • PHP 8.2: Affected versions 8.2.0–8.2.34 · First fixed version: 8.2.35
  • PHP 5.4–8.1: No upstream fix released. End-of-life and have no planned fix. Migration to a supported branch is required.

Recommendation

Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Organisations using older versions of PHP are highly encouraged to update to a fully supported version.

Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, matching the branch in use. PHP states that no configuration change fully mitigates these vulnerabilities.

  1. Inventory every server and application that runs PHP, starting with internet-facing systems.
  2. Update each installation to the fixed release for its branch. Linux distributions were given the patches ahead of release, so look for updated packages from your distribution.
  3. Restart every PHP worker after updating so the fix takes effect.
  4. For PHP 7.4, 8.0 and 8.1, use a distribution or LTS vendor package or PHP’s minimal source backports, or upgrade to a supported branch.
  5. Restrict internet access to any PHP system that cannot be updated immediately.

Source

https://security.paloaltonetworks.com/CVE-2026-109618

https://aws.amazon.com/security/security-bulletins/2026-143-aws

https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php