Source: Vulnerabilities and Threat Research – Qualys Security Blog
Author: Saeed Abbasi
URL: https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities
ONE SENTENCE SUMMARY:
PHP patched two critical unauthenticated RCE flaws; internet-facing mod_php/FPM must upgrade, verify running runtimes, and apply mitigations temporarily.
MAIN POINTS:
- Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution.
- Each issue is rated CVSS v4.0 9.2, demanding urgent remediation prioritization.
- Apache mod_php is especially exposed because exploitation can occur before application code.
- Cloudflare observed active attack traffic, including attempts to evade protective controls.
- Out-of-memory interruption can leave partially initialized request state, leading to corruption and RCE.
- Use-after-free arises when stale global references persist across worker requests, enabling RCE.
- Researchers demonstrated unauthenticated PHP worker memory disclosure, leaking secrets like API keys.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- End-of-life branches need vendor builds, source backports, or upgrades to supported releases.
- Mitigations include disabling session upload progress, adjusting memory_limit, and restarting workers.
TAKEAWAYS:
- Patch internet-facing PHP stacks first, focusing on mod_php and long-lived workers.
- Validate vendor package versions carefully because backports may mask upstream version numbers.
- Confirm remediation by restarting services/containers and ensuring the runtime serving traffic is patched.
- Use temporary hardening only as stopgaps, then roll back emergency settings after patching.
- Inventory all PHP instances, including parallel installs and containers, to avoid missed vulnerable runtimes.