PHP | Remote Code Execution | CVE-2026-109618 | CVE-2026-109619 | Emergency Patching
Source Material: PHP Security Notice; CERT-EU Advisory 2026-018 | Technology: PHP runtime | Targeting: Opportunistic
Executive Summary
PHP has released official emergency security updates addressing two critical remote code execution (RCE) vulnerabilities rated CVSS v4.0 9.2: CVE-2026-109618 and CVE-2026-109619. Official patches are live for all supported branches: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, and PHP 8.5.12.
Both flaws stem from unsafe memory management during longjmp() fatal error handling. CVE-2026-109618 allows unauthenticated RCE via out-of-memory (OOM) triggers that leave request memory uninitialized. CVE-2026-109619 allows RCE via global memory pointers referencing freed memory regions (use-after-free). Active in-the-wild exploitation has been confirmed, making immediate emergency patching critical for all internet-facing PHP deployments.
Organizations should treat internet-facing PHP as an emergency patching priority. Inventory PHP runtimes, deploy the official vendor-fixed release immediately, and validate the runtime version actually serving web traffic. Where immediate patching is not possible, isolate or restrict access to affected services, prevent direct origin bypass, reduce service privileges and reachable credentials, and preserve web, WAF, PHP, process, and network telemetry for investigation.
Threat Overview and Strategic Impact
Official technical details released with the 21 October 2026 patches confirm that both CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2) stem from improper control flow and memory management in PHP’s longjmp() fatal error handling routines:
- CVE-2026-109618: Handling out-of-memory (OOM) fatal errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve remote code execution using crafted OOM triggers.
- CVE-2026-109619: Fatal error handling via longjmp() leaves global memory pointing to freed memory regions, enabling attackers to read or branch on these regions during subsequent web requests to execute arbitrary code.
The scope affects PHP versions from PHP 5.0.0 through PHP 8.5.11. Official fixed releases are live for supported branches (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12), while PHP 8.1 and older upstream branches are end-of-life and require backported updates from operating system or hosting providers. Distribution, hosting, appliance, and container providers may publish backported fixes or rebuilt images on their own schedules; package version strings alone may therefore require vendor-specific validation.
Threat activity has escalated rapidly following public proof-of-concept availability. Threat intelligence monitoring confirms active in-the-wild exploitation targeting vulnerable PHP deployments, with targeted entities taking affected web applications offline as a precaution. Organizations must immediately transition from pre-patch defensive isolation to active deployment of fixed runtime builds.
With the RCE characterization now confirmed, successful exploitation allows code execution in the security context of the PHP worker. Likely consequences include theft of application secrets, database credentials or cloud tokens; modification of web content; deployment of web shells or other persistence; lateral movement; service disruption; and use of a trusted server for follow-on attacks. Risk is highest for internet-facing services, unsupported PHP branches, origins reachable around edge controls, and workers with excessive filesystem, network, or identity permissions. Updating WordPress, Drupal, Laravel, Magento, or another application does not necessarily update the underlying PHP runtime.
Security Hardening and Recommendations
- Identify every PHP runtime, including PHP-FPM pools, Apache modules, CGI/FastCGI deployments, containers, appliances, development systems, and managed hosting. Prioritize internet-facing and privileged workloads.
- Immediately deploy the official fixed release for your active branch (8.2.35, 8.3.36, 8.4.27, or 8.5.12) or vendor/OS backported updates. Restart web-service worker processes (php-fpm, httpd, apache2, nginx) and verify the active runtime version serving HTTP traffic, rather than relying solely on php -v CLI output.
- Upgrade unsupported PHP branches. If immediate upgrade is impossible, remove the service from public access or place it behind VPN, allowlisting, or authenticated access controls; verify that the origin cannot be reached directly.
- Treat WAF rules and disabling session upload progress as defense-in-depth only. PHP contributors and current reporting caution that configuration changes do not replace patching. If operationally safe, restrict unnecessary multipart requests at the edge across HTTP methods, but test for application impact.
- Limit PHP worker privileges, writable paths, outbound network access, secrets, cloud roles, and access to management networks. Preserve off-host logs and confirm recoverable backups.
- After patching, review activity from at least 20 October 2026 through remediation for exploitation or post-exploitation behaviors.
Detection Strategy
No validated vulnerability-specific indicators or public detection signatures are available yet, however Adversary Tactics & Intelligence will continue analyzing additional information as it becomes available. In the meantime, Deepwatch will continue behavior-based monitoring.
WAF, reverse-proxy, web-server, PHP-FPM, application, EDR, audit, container, DNS, and network-flow telemetry should be reviewed for unusual multipart bodies across HTTP methods, repeated or malformed upload requests, spikes in 4xx/5xx responses, worker crashes or restarts, and requests immediately followed by anomalous process or network activity. Do not assume POST-only inspection is sufficient.
Prioritize child processes spawned by php-fpm, php, httpd, apache2, or nginx; unexpected shells or interpreters; command-line download utilities; outbound connections from web-service accounts; creation or execution of scripts in web roots, upload directories, or temporary paths; and access to credential files, cloud metadata endpoints, SSH keys, cron, or systemd configuration. Correlate suspicious events by host, container, source IP, request ID, and timestamp.
How Deepwatch Protects Our Customers
Deepwatch monitors customer-provided endpoint, identity, network, cloud, WAF, and web-server telemetry for exploitation and post-exploitation behaviors relevant to this advisory. Our expert analysts will investigate suspicious web activity with PHP worker process creation, command execution, unexpected outbound connections, credential access, persistence, and follow-on lateral movement attempts, and escalate findings accordingly.
Customers should confirm that internet-facing PHP hosts, containers, reverse proxies, WAFs, and relevant cloud services are sending current telemetry to Deepwatch and that process-command-line and network visibility are enabled where supported. Coverage depends on the data sources and controls deployed in each environment, and monitoring does not replace upgrading the PHP runtime. Customers should use the remediation steps in the PHP advisory and coordinate emergency changes with their infrastructure, application, and hosting providers.
Relevant Detections
Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.
Threat Hunting Leads
- Hunt for php-fpm, php, httpd, apache2, or nginx spawning shells, interpreters, download tools, or system utilities.
- Correlate unusual multipart/form-data requests across HTTP methods with worker errors, process creation, file writes, or outbound traffic.
- Review new or modified PHP files, executable content, and permission changes in web roots, upload locations, session storage, and temporary directories.
- Identify outbound DNS, HTTP(S), or raw socket activity from web-service accounts to rare or newly observed destinations.
- Review access to application secrets, environment files, database credentials, cloud metadata services, SSH keys, and service-account tokens.
- Check for new cron entries, systemd units, SSH authorized keys, containers, user accounts, or other persistence after suspicious requests.
Technical Artifacts
Please visit the Guardian Platform to access available technical artifacts for this report.
Threat Object Mapping
Intrusion Set:
- Unknown
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Initial Access | Exploit Public-Facing Application | T1190 | Likely initial-access path if public unauthenticated RCE reporting is confirmed; Cloudflare reported early attempts, not confirmed compromise. |
| Execution | Command and Scripting Interpreter | T1059 | Potential follow-on execution after successful RCE; no confirmed incident chain at cutoff. |
| Persistence | Server Software Component: Web Shell | T1505.003 | Potential post-exploitation outcome; no verified web shell linked to these CVEs at cutoff. |
Vulnerabilities:
- CVE-2026-109618 – Critical PHP vulnerability; confirmed unauthenticated RCE via longjmp() out-of-memory error handling.
- CVE-2026-109619 – Critical PHP vulnerability; confirmed unauthenticated RCE via longjmp() fatal error handling referencing freed global memory.
Malware/Tool:
- None publicly confirmed.
Additional Sources
- Security advisory: Critical remote code execution vulnerabilities, update now
- PHP: Upcoming Critical PHP Security Release
- CERT-EU Security Advisory 2026-018
- watchTowr: PHP RCE FAQ
- The Hacker News: What Actually Protects You Before the Patch
- Tenable: php2shell FAQ
- BleepingComputer: PHP Emergency Patch Reporting
- CISA Known Exploited Vulnerabilities Catalog
- PHP Supported Versions
Share