Two critical vulnerabilities in PHP, publicly disclosed on October 21, 2026 and tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely on vulnerable servers under certain conditions, potentially without authentication. Security fixes are already available, so the priority right now is finding every affected system and confirming it has been patched.
Why should businesses care?
PHP powers a huge share of the web, including WordPress sites, e-commerce platforms and countless custom business applications. If your organization runs a website or web application, there is a good chance PHP is somewhere in the stack. A vulnerable server could expose your organization to:
- Unauthorized access to systems and the data they hold.
- Data exposure, including customer and business information.
- Malware deployment and further compromise of connected systems.
- Business disruption and the cost of incident response and recovery.
What are the vulnerabilities?
Both flaws live in PHP's core memory management and error handling, code paths that nearly every request touches. The PHP project rates them at CVSS 9.2, and researchers have dubbed the pair "php2shell".
- CVE-2026-109618 is a remote code execution bug triggered through out-of-memory handling. If a request hits PHP's memory limit at the wrong moment, PHP can leave partially initialized internal data behind and later treat it as valid, corrupting memory.
- CVE-2026-109619 is a use-after-free. A fatal error at the wrong point can leave a worker pointing at memory freed from a previous request, which a later request can then reuse.
The risk is highest on Apache with mod_php, where researchers demonstrated that a single unauthenticated request can trigger the bug before any application code runs, with default settings. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed setups are affected too. A proof of concept is already circulating; no active exploitation had been identified at disclosure, but that can change quickly once patches let attackers work out the details.
Which PHP versions are affected?
Fixed versions shipped on October 21, 2026. Anything older in each branch is vulnerable:
- PHP 8.5 — fixed in 8.5.12
- PHP 8.4 — fixed in 8.4.27
- PHP 8.3 — fixed in 8.3.36
- PHP 8.2 — fixed in 8.2.35
PHP 8.1 and older no longer receive official updates. The PHP security team did publish minimal source-code backports for 7.4, 8.0 and 8.1, and most Linux distributions and LTS vendors ship patched packages, so if you are on an older version, contact your vendor or upgrade to a supported release. Worth noting: PHP 8.2 itself reaches end of life on December 31, 2026, so if that is your branch, plan the larger upgrade now rather than twice.
What should organizations do?
- Identify PHP installations across your servers, applications and cloud environments. You cannot patch what you have not found.
- Apply the security updates released by the PHP project as a priority.
- Review exposed systems for suspicious activity, especially anything internet-facing.
- Confirm your vulnerability management and security monitoring processes are in place, so the next disclosure is handled as routine rather than as an emergency.
If you cannot patch immediately: the PHP project published interim mitigations, such as hardening the memory limit and disabling session upload progress, but is clear that they only reduce exposure; updating is the only complete fix. Until then, consider isolating internet-facing PHP applications, and do not forget appliances, third-party products and containers that bundle their own copy of PHP.
What if a third party manages your website?
Many businesses do not host or maintain their own websites. If yours is managed by a hosting provider, agency or web developer, they are best placed to confirm your exposure and handle the remediation. We recommend three quick steps:
- Contact your hosting provider or web developer and share this advisory.
- Ask them to confirm whether your website or application is affected.
- Get written confirmation that the required security updates have been applied.
How DIST can help
At DIST, we believe proactive security is essential to reducing risk before vulnerabilities become business-impacting incidents. If you are unsure whether your environment is affected, or you want help with vulnerability management, threat detection and remediation, our cybersecurity team can assess your exposure and walk you through the fix. If you have any questions, feel free to reach out to our team.
References
- PHP security advisory: https://www.php.net/
- PHP Foundation security update: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- Canadian Centre for Cyber Security advisory: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
