Two Critical PHP RCE Vulnerabilities Patched in 2026: What Security Teams Must Do Now
In October 2026, PHP maintainers disclosed and patched two critical unauthenticated remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. The first flaw exploits out-of-memory handling that interrupts PHP during partial request initialization, causing request cleanup to treat invalid data as valid and enabling arbitrary code execution. The second flaw allows request-owned internal state to persist after its backing memory is freed, letting a subsequent request handled by the same worker consume stale state before initialization resets it. All major PHP server configurations—including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed—are affected, with mod_php carrying the highest demonstrated risk. No authentication is required to trigger either vulnerability, meaning exploitation can occur before any application-layer code executes. These vulnerabilities represent a systemic risk to the global web stack, as PHP powers an estimated 77% of server-side websites. The disclosure arrives amid a broader surge in exploitation of web-tier vulnerabilities by both opportunistic actors and nation-state groups, reinforcing the urgency of rapid patching cycles and layered network controls to contain blast radius when patch deployment is delayed.
Kill Chain
