CVE-2026-109618 and CVE-2026-109619: Critical PHP RCE Flaws Trigger Emergency Security Release
Two PHP flaws rated 9.2 need attention now
The PHP team released emergency updates on October 21, 2026, for CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2 and can allow an unauthenticated attacker to execute code on a vulnerable server.
That is serious news. It does not mean every small business website is being actively attacked. It does mean a PHP server exposed to the internet should not sit unpatched while someone waits for a convenient maintenance window.
What these vulnerabilities actually do
CVE-2026-109618 involves memory corruption during out-of-memory handling. Under the wrong conditions, PHP can leave internal request data only partly initialized, then treat that data as valid during cleanup.
CVE-2026-109619 involves stale process state. Data belonging to one request can remain after the memory behind it has been released. A later request may then interact with that leftover state.
Those descriptions sound abstract because they are. The business impact is simple. A carefully crafted web request may cause PHP to run attacker-controlled code, read data available to the PHP process, or crash the service.
Which servers are exposed
Reportedly vulnerable versions run from PHP 5.4 through PHP 8.5.11. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Servers using Apache with mod_php deserve immediate attention. A crafted unauthenticated HTTP request can reach the vulnerable PHP handling with the default configuration, before the website application has a chance to help.
PHP-FPM is not automatically safe. The exact risk depends on how the application, web server, worker processes, and request paths are configured. Researchers also demonstrated risk through application-stage paths. That makes a blanket statement about every PHP-FPM installation impossible.
WordPress, Drupal, Laravel, ecommerce platforms, internal portals, and custom PHP applications may all be affected if the underlying runtime is old. Updating the application alone will not fix the PHP process.
What we would do for a 30-person company
We would start with inventory, not panic. Find every internet-facing server, virtual machine, hosting account, container, and managed website that runs PHP. Ask the hosting provider for the active PHP version. Do not assume the version shown in a control panel applies to every site.
Then we would record whether each system uses mod_php or PHP-FPM, identify the fixed version available for its PHP branch, and schedule the update immediately. Before changing production, we would take a current backup and test the site’s login, forms, payments, file uploads, and scheduled jobs.
If a server cannot be patched today, we would treat it as an exception that needs a named owner and a short deadline. We would also restrict unnecessary exposure, review web server logs for unusual requests, and check for unexpected files, new administrator accounts, changed scheduled tasks, or outbound connections from the web server.
Do not spend this week buying a new firewall because of this headline. A firewall can reduce noise, but it does not repair vulnerable PHP code already accepting web requests. Patch management and knowing what you actually operate come first.
How urgent is this?
The two vulnerabilities received their CVE identifiers on October 21, 2026, the same day the emergency releases became available. Public reporting also describes demonstrated remote code execution against mod_php and a real-world application path.
That raises the priority. It does not prove that your company has been compromised. It does justify checking logs before and after the update, especially if the server handled public traffic while running an affected version.
We would not wait for a software vendor to publish a plugin update. The runtime is the issue. If your website is hosted by someone else, ask one direct question today: “Which fixed PHP version is running my site, and when was it installed?” If nobody can answer, IT911Now can help verify the exposure and put a patch plan in place.
