PHP Patches Two Critical RCE Flaws That Were Already Under Attack

On October 21, PHP released emergency updates to address two critical vulnerabilities that had already been exploited. The flaws, both rated 9.2 under CVSS v4.0, are known as CVE-2026-109618 and CVE-2026-109619. They represent memory-safety failures in the request lifecycle, with one occurring during out-of-memory handling and the other in state that outlives the memory backing it. Sansec reports that these vulnerabilities are present in every unpatched PHP version since 5.4.

The PHP Foundation disclosed the CVE identifiers two days early, which allowed a researcher to mistakenly publish a video showing a proof of concept. Chainguard also broke the embargo and published built images containing the fix, making it easy for attackers to study the fix in binary form while other PHP users waited for the release. Exploitation attempts were made as early as October 17, according to Amazon Threat Intelligence.

Apache mod_php and PHP-FPM were confirmed as susceptible to remote code execution, with the former validated over HTTP against mod_php with default PHP input and memory limits. FrankenPHP may also be at risk. Attackers found it difficult to identify if PHP was running at all, as it could be behind various home server software such as OPNsense, OpenMediaVault, Nextcloud, and Coolify.

Debian Trixie released updates quickly, while Ubuntu, Red Hat, and official Docker images lagged behind. Ubuntu's security team published their fix thirteen minutes after disclosure, leaving Ubuntu 24.04 users with a fixed package that still reported the outdated version. Many distro builds and container images still contained the vulnerable code.

The PHP Foundation acknowledges that security work on PHP still depends on a small group of foundation-funded developers, resulting in an upgrade gap for PHP 8.1 and older versions. PHP advises setting session.upload_progress.enabled=0 until the next bugfix release to mitigate the risk of further exploitation.