PHP Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619: How to Patch

Two critical bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, can let an attacker run code on a web server without logging in. They were fixed on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and every earlier release on those branches is affected. If your website, WordPress install or API runs on PHP, the fix is to upgrade the PHP runtime, not your plugins or framework.

What happened

The PHP project published two GitHub security advisories on 21 October 2026, both rated Critical with a CVSS v4 score of 9.2. On the same day it shipped patch releases on all four supported branches. The release notes put it bluntly: "There are no complete mitigations, updating is the only safe choice."

The score reflects a network attack that needs no account and no user interaction, but does need certain conditions to line up (that is why attack complexity is marked high). In plain terms: it is not trivial to pull off, but an outsider can attempt it against a public server, and the payoff is full control of the PHP worker process.

Note that the 8.2.35 release notes also remind users that PHP 8.2 reaches end of life on 31 December 2026. Branches older than 8.2 are not listed in the advisories, so treat them as unpatched and unsupported.

The two bugs, explained without the jargon

CVE-2026-109618: memory exhaustion leaves PHP in a broken state

When a PHP request runs out of memory, the engine historically bailed out of whatever it was doing with an abrupt jump. The advisory explains that some code paths make freshly allocated request memory visible before it is fully set up. If any allocation fails at that exact moment, even an unrelated one, the request is left holding half-initialised data, and the shutdown routine later trusts it.

The scary part is how an attacker forces the out-of-memory condition. The advisory lists several ways, including multipart (file upload style) requests with a huge number of headers per part, many empty file fields that still create metadata, and deeply nested field names. Under Apache with mod_php, the researchers confirmed full remote code execution over HTTP with default memory and input limits, before any of your application code even runs. PHP-FPM is believed to be susceptible based on source analysis, but no complete FPM exploit was demonstrated. FrankenPHP and LSAPI are flagged as likely susceptible but not validated.

The fix replaces the abrupt jump with a graceful "soft" out-of-memory stop at a safe point, plus a hard process exit if memory keeps climbing past a second threshold.

CVE-2026-109619: leftover state from a previous request

Long-running PHP workers handle many requests in a row. This advisory describes global state (error, session, object and extension data) that can survive after the memory behind it is freed. A later request that touches that state before normal start-up reads freed memory, which is a classic use-after-free.

Two confirmed paths stand out:

• PHP 8.5 with fatal_error_backtraces enabled. The backtrace data is not cleared after a fatal error, and a later diagnostic reads it. This is the basis of the confirmed mod_php exploit.
• Session upload progress. This feature is on by default and does not need your code to call session_start(). A fatal error or memory exhaustion during input processing can leave it pointing at freed memory. It was validated against both mod_php and PHP-FPM.

An attacker needs two requests to land on the same worker: one to plant the stale state and one to trigger it. More workers make that harder, but the advisory is clear that it does not remove the risk.

Who is affected

If any of these describe your setup, you should act this week:

• A WordPress, WooCommerce, Laravel, Symfony, Drupal or custom PHP site on a PHP version below the fixed releases above.
• Apache with mod_php. This is the configuration with confirmed, application-independent exploitation.
• PHP-FPM behind nginx or Apache. Exposure is conditional, but session upload progress was validated on FPM.
• Docker images that pin an older php:8.x tag and have not been rebuilt since 21 October.
• Shared or managed hosting. Your host controls the PHP binary, so you need to confirm they have rolled out the patched build.

Updating WordPress core, a theme or a plugin does nothing here. The bug lives in the language runtime underneath them.

How to patch: a practical checklist

1. Find your real PHP version. The command-line PHP and the web-server PHP are sometimes different builds, so check both.

# CLI version
php -v

# FPM version (binary name varies by distro, e.g. php-fpm8.3)
php-fpm -v

# Settings that matter for the mitigations below
php -i | grep -E 'memory_limit|session.upload_progress.enabled|fatal_error_backtraces'

For the web server, a temporary phpinfo() page works, but delete it straight after.

2. Upgrade to the fixed release for your branch. Use your distribution's security repository, your host's control panel, or a rebuilt container image. For Docker, bump the base image tag and rebuild rather than relying on a cached layer.

# Example: confirm the image you ship actually contains the fix
docker run --rm your-app-image php -v

3. Restart every worker. A new binary on disk does not help while old FPM children or Apache processes stay in memory. Restart the service, not just reload configuration.

4. Verify in production. Re-run the version check against the live server and record the result.

5. Plan your branch. If you are on 8.2, schedule a move to 8.3 or newer before the end of December. If you are on anything older than 8.2, upgrading is now urgent rather than optional.

If you cannot upgrade today

Both advisories list temporary measures. In summary:

• Turn off session upload progress (session.upload_progress.enabled=0) and restart workers. The advisory suggests leaving it off even after patching if you don't use it, and most sites don't.
• On PHP 8.5, set fatal_error_backtraces=0 at the administrative level and restart. This removes the confirmed exploit path for the second bug, but not every possible one.
• Tighten request limits at the edge. Keep post_max_size conservative, cap decoded request size at your reverse proxy or WAF, and block multipart requests entirely on endpoints that never accept uploads.
• Lower input limits such as max_input_nesting_level and the number of input variables, parts and uploads.
• Avoid RLIMIT_AS and RLIMIT_DATA as a memory cap. The advisory warns these make allocations fail in exactly the way that triggers the first bug.

The first advisory also mentions memory_limit=-1 as a partial configuration mitigation, with the caveat that it is incomplete and that an unbounded memory limit brings its own denial-of-service risk. Treat it with care.

What it means for business and app owners

For a non-technical founder, the short version is this: your website's engine had a serious flaw, and the engine has to be replaced, not the bodywork. Ask whoever runs your hosting or code three direct questions:

• Which PHP version is serving our live site right now?
• When was it updated, and were all workers restarted?
• Are we on a branch that still gets security fixes after this year?

If nobody can answer quickly, that is a sign your stack lacks basic visibility, and a one-off production audit of versions, hosting and patching is usually great value compared with cleaning up after a breach. If you run WordPress and want someone to handle the PHP upgrade and test your plugins against the new version, WordPress development support covers exactly that kind of job.

The broader lesson is that "keep plugins updated" is only half of PHP security. The runtime, the web server and the container image all need an owner and a patch routine, and this month's release is a good prompt to set one up.

Sources

• PHP security advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618) (opens in a new tab)
• PHP security advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619) (opens in a new tab)
• php-src releases on GitHub (8.5.12, 8.4.27, 8.3.36, 8.2.35) (opens in a new tab)
• php-src security advisories overview (opens in a new tab)
• Cover photo: FlyD on Unsplash