XemmeX NetworkIntelligence & Technologies
Computer security

CVE-2026-109618 and CVE-2026-109619: two critical faults in PHP

Two critical flaws allow you to attack PHP servers without authentication. Discover the affected versions, fixes and help of XemmeX.

XemmeX22 October 20265 min
CVE-2026-109618 and CVE-2026-109619: two critical faults in PHP

Two critical vulnerabilities discovered in the core of PHP can allow an unauthenticated attacker to run remote code on a web server. Identified under references CVE-2026-109618 and CVE-2026-109619, each received a rating of 9.2 out of 10 according to CVSS 4.0.

The PHP project issued emergency fixes on 21 October 2026 and recommended an immediate update. His [official notice] (https://www.php.net/archive/2026.php) is unambiguous: no circumvention measures fully protect a vulnerable system. Updateing PHP remains the only complete solution.

Why these flaws are particularly serious

A remote code execution vulnerability, or NCE, may allow an attacker to have his or her own instructions executed through the PHP process. The access obtained corresponds first to the privileges of the account used by the web server, but it may be sufficient to view or edit files, steal identifiers, inject a back door, divert a site, send spam or install a cryptominator.

The attack requires neither user account nor prior access to the administration panel. The risk concerns PHP installations that handle web queries, including PHP-FPM, Apache with mod php, php-cgi, FrankenPHP and LiteSpeed. The PHP project currently considers the risk to be particularly high with mod php, for which exploitation was demonstrated even before the application code was executed.

CVE-2026-109618: corruption during memory loss

PHP uses a mechanism called longjmp() to interrupt certain treatments when the memory available for a query is exhausted. Under certain circumstances, this interruption may occur while internal data are only partially initialized. The procedure for closing the request can then treat the invalid memory as if it were legitimate.

According to [official technical opinion] (https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), specially constructed multipart queries can cause this state. Several techniques allow you to consume much more memory to PHP than the apparent size of the query suggests, including a large number of headers, nested fields or upload metadata.

Researchers validated remote code execution without authentication against Apache mod php. PHP-FPM reduces some attack paths because a child process can be interrupted after a start failure, but it is not declared immune: application-related scenarios remain possible.

CVE-2026-109619: an internal state reused between two queries

The second flaw concerns internal data that can survive the request that created them, even after the release of the corresponding memory. If the same PHP process then processes another query, it can reuse this outdated pointer before its normal state is properly reset. It is a form of post-release memory use, commonly referred to as "use-after-free".

In particular, it describes paths that involve tracking the progress of session uploads, fatal errors and certain configuration diagnoses. Full operation requires several conditions and may depend on version, extensions and configuration. However, this does not make the theoretical flaw: operating chains have been demonstrated on common applications.

Which versions should be corrected?

The corrected versions published by the PHP project are as follows:

  • PHP Branch - Minimum corrected version

PHP 8.5 PHP 8.4 PHP 8.3 PHP 8.2 No new official version of the branch; migration or retroactive correction of the required supplier

The confirmed affected versions range from PHP 5.4 to PHP 8.5.11. Some Linux distributions, including AlmaLinux, Red Hat, Debian and Ubuntu, can integrate the patch into their own packages without adopting the same version number as PHP.net. In this case, php -v is not always enough: you must also check the version of the package, its logbook and the security notice of the provider.

PHP 8.1 and earlier branches arrived at the end of their lives with the PHP project. Some distributors offer an exceptionally backward patch, but this does not turn an old branch into a durable solution. A migration to a still supported version must be planned.

Update CMS does not fix PHP

WordPress, Drupal, Joomla, Laravel, Symfony, Magento and custom applications rely on PHP, but do not replace it. Updating the site, its extensions or its Composer dependencies usually does not update the interpreter installed on the server.

The intervention must cover all present versions. A cPanel or WHM server can host multiple PHP branches in parallel; the command executed in the terminal can therefore display a different version than that used by a domain. PHP-FPM, Apache or LiteSpeed processes must also be restarted after the patches are installed so that no old vulnerable processes remain in memory.

The patch must be followed by a compromise check

Installing the update closes the fault, but does not erase actions that could have been done before. When the server was exposed, it is prudent to examine Web and PHP logs, repeated memory errors, unusual HTTP 500 responses, suspicious multi-part uploads, new executable files, planned tasks, created accounts and unknown processes.

The presence of a suspicious request does not automatically prove a compromise. Conversely, a lack of alert in the application log is not sufficient to conclude that the system is healthy, since vulnerabilities act in the PHP engine and sometimes before the application starts normally.

How XemmeX Technologies can help you

XemmeX Technologies can intervene directly in your environment, whether it is an internal server, cPanel/WHM hosting, a VPS server at OVHcloud or an infrastructure hosted with another provider.

Intervention may include:

  • inventory of actual PHP versions used by each site and service;
  • verification of the operating system, repositories and backported packages;
  • prior backup and assessment of compatibility of applications;
  • installation of corrected versions or migration of an end-of-life branch;
  • the controlled restart of PHP-FPM, Apache or LiteSpeed;
  • validation of each site after intervention;
  • examination of newspapers and indicators which may reveal an attempt to exploit or compromise;
  • strengthening the configuration and providing a technical report.

To have your server checked or corrected:

Conclusion

CVE-2026-109618 and CVE-2026-109619 touch the layer that runs the entire web application. Their seriousness, lack of authentication and the public availability of technical information require a rapid response.

The right approach is to inventory all PHP instances, apply provider fixes, restart services, validate applications and verify that no previous compromise has gone unnoticed.