Two Critical PHP RCE Vulnerabilities Patched in 2026: What Security Teams Must Do Now
Executive Summary
In October 2026, PHP maintainers disclosed and patched two critical unauthenticated remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. The first flaw exploits out-of-memory handling that interrupts PHP during partial request initialization, causing request cleanup to treat invalid data as valid and enabling arbitrary code execution. The second flaw allows request-owned internal state to persist after its backing memory is freed, letting a subsequent request handled by the same worker consume stale state before initialization resets it. All major PHP server configurations—including mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed—are affected, with mod_php carrying the highest demonstrated risk. No authentication is required to trigger either vulnerability, meaning exploitation can occur before any application-layer code executes.
These vulnerabilities represent a systemic risk to the global web stack, as PHP powers an estimated 77% of server-side websites. The disclosure arrives amid a broader surge in exploitation of web-tier vulnerabilities by both opportunistic actors and nation-state groups, reinforcing the urgency of rapid patching cycles and layered network controls to contain blast radius when patch deployment is delayed.
Why This Matters Now
PHP underpins the majority of the public internet, and unauthenticated pre-application RCE means attackers can compromise servers before any WAF rule or application control fires. With active exploit demonstrations already circulating and no workaround other than patching, organizations running unpatched PHP instances face immediate, weaponizable exposure to full server takeover, lateral movement, and data exfiltration across cloud and hybrid environments.
Attack Path Analysis
An unauthenticated attacker targets internet-exposed PHP installations (mod_php, PHP-FPM, php-cgi) by sending crafted HTTP requests that trigger OOM corruption (CVE-2026-109618) or stale global state reuse (CVE-2026-109619) before any application code executes, achieving remote code execution on the web server process. From that initial foothold the attacker escalates within the compromised worker, moves laterally across internal workloads, establishes outbound command-and-control channels, exfiltrates sensitive data, and ultimately disrupts or destroys hosted services.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker sends a specially crafted unauthenticated HTTP request to an internet-facing PHP endpoint running a vulnerable version (< 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12). The request triggers either out-of-memory handling mid-initialization (CVE-2026-109618) or stale worker-global state from a prior freed request (CVE-2026-109619), causing arbitrary code execution in the PHP worker process before application-layer authentication or input validation can run. mod_php is confirmed highest risk with a demonstrated pre-auth exploit path.
Related CVEs
CVE-2026-109618
CVSS 9.8An out-of-memory condition in PHP can interrupt request processing while internal request data is only partially initialized. During cleanup, the partially initialized data may be treated as valid, enabling unauthenticated remote code execution before any application code runs.
Affected Products:
The PHP Group PHP – < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12
Exploit Status:
proof of conceptCVE-2026-109619
CVSS 9.8Request-owned internal state in PHP can survive after its backing memory has been freed. A subsequent request handled by the same worker process may access that stale state before normal initialization resets it, leading to unauthenticated remote code execution.
Affected Products:
The PHP Group PHP – < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Client Execution
Exploitation for Defense Evasion
Command and Scripting Interpreter
Exploitation for Privilege Escalation
Endpoint Denial of Service
Software Deployment Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Vulnerability and Patch Management
Control ID: Section 500.7 — Access Privileges and Section 500.14(b)
DORA (Digital Operational Resilience Act) – ICT Vulnerability and Patch Management Controls
Control ID: Article 9 — ICT Security and Article 10 — Detection
NIS2 Directive – Vulnerability Handling and Patch Management
Control ID: Article 21 — Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Continuous Application-Layer Vulnerability Remediation
Control ID: Application Workload Pillar — Visibility and Analytics / Automation and Orchestration
ISO/IEC 27001:2022 – Technical Vulnerability Management
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 expose IT infrastructure running mod_php, PHP-FPM, and Apache to unauthenticated remote code execution before application code initializes, demanding immediate patching.
Financial Services
PHP-driven financial platforms face unauthenticated RCE risk with PCI 4.0 and NIST 800-53 compliance implications; lateral movement and exfiltration of sensitive transaction data are critical post-exploitation concerns requiring zero trust segmentation.
Health Care / Life Sciences
PHP web applications in healthcare environments risk HIPAA violations under 164.308 and 164.312 controls, as unauthenticated RCE via stale global state or OOM corruption could expose protected health information through uncontrolled lateral movement.
Internet
Web-facing PHP deployments across internet platforms are highest-risk targets; unauthenticated exploit triggers before application logic runs, enabling cloud-scale compromise requiring inline IPS signatures, egress controls, and multicloud visibility enforcement immediately.
Sources
- New Serious PHP Vulnerabilities Released and Patchedhttps://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.htmlVerified
- PHP 8.4 ChangeLog - php.nethttps://www.php.net/ChangeLog-8.php#PHP_8_4Verified
- GitHub Advisory GHSA-w8hw-w9fx-j79w - RCE via OOM corruption in PHPhttps://github.com/advisories/GHSA-w8hw-w9fx-j79wVerified
- GitHub Advisory GHSA-6wmf-4rv5-p3rp - RCE via stale global state in PHPhttps://github.com/advisories/GHSA-6wmf-4rv5-p3rpVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant because this attack chain depends on unrestricted reachability to vulnerable PHP endpoints, uncontrolled east-west paths for lateral movement, and open egress for command-and-control and data exfiltration. By enforcing segmentation, identity-scoped workload access, and controlled egress policy, CNSF would likely reduce the attacker's ability to move freely after initial compromise and limit the overall blast radius across the environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network-layer segmentation policy could reduce the reachable attack surface by limiting which internet sources may reach PHP-serving workloads, potentially constraining opportunistic or broad-range exploitation attempts against vulnerable endpoints.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policies could constrain what internal resources and credential stores the compromised worker process identity is permitted to reach, likely reducing the attacker's ability to harvest high-value secrets or escalate to cloud-platform-level access.
Control: East-West Traffic Security
Mitigation: East-west policy enforcement would likely constrain the attacker's ability to reach adjacent workloads, internal databases, or container services from the compromised PHP host, reducing the scope of lateral movement across the internal environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud traffic visibility could surface anomalous outbound connection patterns from the PHP workload to unauthorized external destinations, and policy enforcement may constrain which outbound paths the compromised worker is permitted to use.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement could constrain which external destinations the PHP workload is permitted to reach, likely reducing the attacker's ability to transfer data to unauthorized external endpoints or cloud storage targets.
Because prior CNSF controls would likely have constrained lateral movement paths, egress channels, and workload reachability, the attacker's ability to achieve broad destructive impact across the full environment would probably be reduced to a more limited scope, with damage more likely confined to the initially compromised PHP workload rather than spreading freely across internal services, databases, and backup stores.
Impact at a Glance
Affected Business Functions
- Web Application Hosting and Delivery
- API and Backend Service Operations
- E-commerce Transaction Processing
- Content Management System (CMS) Operations
Estimated downtime: 1 days
Estimated loss: N/A
Any PHP-based web application serving requests via mod_php, PHP-FPM, php-cgi, FrankenPHP, or LiteSpeed is at risk of full server compromise before application-level authentication or authorization code executes. Sensitive data categories at risk include: user PII stored in application databases, session tokens and authentication credentials, proprietary application source code, financial transaction records in e-commerce environments, and any backend secrets or API keys accessible to the web server process. The severity is highest for organizations that have not patched, as unauthenticated exploitation requires no user interaction.
Recommended Actions
Key Takeaways & Next Steps
- • Patch immediately and enforce version gates at the network edge: Deploy CNSF Inline IPS (Suricata) with updated signatures targeting CVE-2026-109618 and CVE-2026-109619 exploit patterns to detect and block malicious HTTP payloads reaching vulnerable PHP workers, buying time before patching to 8.2.35+/8.3.36+/8.4.27+/8.5.12+ is complete across all instances.
- • Apply Zero Trust Segmentation to PHP workloads: Enforce identity-based microsegmentation and least-privilege policies so that PHP worker process identities can only reach explicitly authorized internal services and data stores; prevent lateral movement to databases, internal APIs, and adjacent pods even after initial compromise.
- • Enforce strict egress security and FQDN filtering: Use Egress Security & Policy Enforcement controls to restrict outbound connections from PHP worker hosts to known-good destinations only, blocking reverse-shell and C2 beaconing attempts to unauthorized external IPs or domains immediately after compromise.
- • Activate Multicloud Visibility & Control to surface anomalous east-west and outbound flows: Enable centralized traffic observability and anomaly detection across the environment to identify suspicious workload-to-workload interactions, repeated malformed requests, or unexpected outbound data volumes that indicate post-exploitation activity following a pre-auth RCE.
- • Encrypt and inspect all data-in-transit paths and enable East-West Traffic Security: Apply MACsec/IPsec high-performance encryption on private circuits and enforce east-west traffic inspection policies between workloads so that lateral movement traffic and exfiltration channels can be detected, logged, and blocked in alignment with NIST.800-53.SC-7 and ZTMM.Network controls.
