PHP Releases Emergency Fixes for Two Critical Remote Code Execution Flaws

The PHP development team has released emergency security updates for two critical vulnerabilities that can allow attackers to execute code on web servers without authentication.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry CVSS 4.0 scores of 9.2. PHP said every installation serving web requests may be exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration because a malicious request can trigger exploitation before application code runs.

PHP described the first vulnerability as memory corruption caused by unsafe handling of an out-of-memory condition. The second involves stale global state that may survive after its backing memory has been freed and then be used by another request.

Updates are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project said there is no complete mitigation and urged users to update immediately. Organizations should also restart PHP workers after installing the corrected packages so running processes load the new code.

John Bruggeman, vCISO at CBTS, said keeping WordPress or another application current does not guarantee the PHP runtime beneath it has been fixed.

"Updating WordPress is not the same as updating PHP. A company can keep its website's application and plugins current and still have vulnerable software running underneath them," Bruggeman said.

Security teams should inventory internet-facing PHP services, confirm patched versions are running, restart long-lived workers and investigate systems showing suspicious requests or unexplained process behavior.