Critical PHP Flaws Disclosed, Patches Out Now

UPDATE--The fixes for the two critical PHP vulnerabilities are now out, and the flaws are both as serious as predicted and can lead to remote code execution.

From the PHP advisory:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Researchers and the PHP team are recommending that organizations update as soon as possible, as both vulnerabilities are critical RCE bugs and active exploitation is expected to start soon.

"All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the advisory says.

Late Tuesday, some details of the two bugs were apparently as defenders and researchers worked to deploy mitigations before widespread exploitation begins. PHP is expected to release patches for all of the affected versions of the language on Wednesday morning and researchers have suggested that turning off session uploads is the best mitigation in the absense of patches.

Security researchers warned about the bugs on Tuesday afternoon after a post with some meager information about the bugs appeared on Hacker News. The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8. 

“In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET. While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS 10 and are understood to affect PHP versions 5, 6, 7, and 8,” Ben Harris, founder and CEO of watchTowr said in a statement.

The PHP advisory for CVE-2026-109618 makes it clear how serious the issue is.

"The confirmed impact is unauthenticated remote code execution as the web worker account. Complete remote code execution was validated over HTTP against mod_php with default PHP input and memory limits and normal prefork configurations with multiple workers. Additional workers and unrelated traffic can increase the required number of attempts but do not remove the condition. Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout," the advisory says.

Researcher Ryan Austin at Calif discovered the bugs and reported them to the PHP team. Calif recommended patching immediately, but suggested some mitigations that can help in the meantime if patching right away isn't an option.

"Patch now. Upgrade to a fixed PHP release as soon as possible. If you cannot patch immediately, the following temporary, partial mitigations may buy you some time:

• For PHP-FPM, disable session upload progress with session.upload_progress.enabled=0 and set memory_limit=-1.
• For mod_php, set memory_limit=-1.

These changes do not replace a patch. Setting memory_limit=-1 removes PHP’s memory cap, increasing the risk of memory exhaustion," Calif's post says.

The PHP Group posted an early notice about the flaws on Tuesday afternoon, shortly after the initial information about the bugs began to seep out.

"All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild," the notice says.

PHP is an overwhelmingly popular scripting language that is found on somewhere north of 60 percent of websites by some estimates. Serious vulnerabilities in PHP are not uncommon, and because the language is so widely used, attackers often favor them when they surface.

Specifics of the two vulnerabilities are still under wraps, but researchers say both of them can lead to remote code execution. 

This story was update on Oct. 21 to add information about the patches.