22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619
In October 2026, Unit 42 researchers disclosed two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619—each carrying a CVSS 4.0 score of 9.2. CVE-2026-109618 exploits improper control flow in out-of-memory error handling via longjmp(), leaving request memory uninitialized and enabling reliable RCE through OOM triggers. CVE-2026-109619 allows attackers to read or branch on freed global memory during subsequent requests, also achieving arbitrary code execution. Palo Alto Networks Cortex Xpanse identified over 22.6 million potentially exposed instances globally, and at least one European government proactively took its public website offline. Proof-of-concept code has been observed by Unit 42 researchers, indicating active weaponization risk. These vulnerabilities reflect a broadening attacker focus on foundational web runtime environments rather than application-layer logic alone. As PHP continues to underpin millions of web servers and content management systems worldwide, critical runtime flaws like these represent a systemic risk that demands immediate patching, attack surface management, and inline threat prevention—particularly as autonomous vulnerability discovery tools lower the bar for exploitation at scale.
Kill Chain
