PHP ships emergency patches for two unauthenticated RCE flaws scoring 9.2 on CVSS

According to the official PHP security advisory, the first flaw, CVE-2026-109618, comes down to memory corruption under out-of-memory conditions: if PHP gets interrupted while request data is only partially initialized, the cleanup that follows can end up treating that incomplete, invalid data as valid. The second, CVE-2026-109619, is a stale-state bug, internal data tied to one request can survive after its memory is freed, and a later request handled by the same worker process can end up reusing it. Either one lets an attacker with no credentials at all trigger remote code execution on the server.

Every setup that handles web requests is exposed: PHP-FPM, Apache running mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team singled out mod_php as the riskiest of the bunch, since on that setup an unauthenticated request can trigger the bug before any of the actual application code even runs, meaning the vulnerability sits underneath WordPress, Joomla, Drupal, or Magento rather than inside them. That’s also why the exposure is so broad: PHP currently runs on roughly 70% of websites with a known server-side language, according to W3Techs, and a large share of that is the PHP-powered CMS platforms built on top of it.

Fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier no longer get official support, though some Linux distributions and LTS vendors are backporting the fix anyway, and the PHP team separately published minimal source patches for 7.4, 8.0, and 8.1 for anyone stuck on those versions. For anyone who can’t update immediately, the advisory lists stopgap mitigations: locking memory_limit to -1 at the server config level rather than the application level and capping request size addresses the first bug, while disabling session.upload_progress.enabled and restarting every worker process addresses the second, with PHP 8.5 users also needing to turn off fatal_error_backtraces.