PHP fixes CVE-2026-109618

The PHP team has released fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU, the Canadian Centre for Cyber Security, AWS, Google, Red Hat and ENISA all said the issues are critical flaws that could allow remote code execution on affected PHP systems, including earlier releases in those branches.

What did the new PHP releases fix?

PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 include patches for both CVEs. The Canadian Centre for Cyber Security said earlier releases in those branches remain affected, while Google identified all PHP versions from 5.4 through 8.5.11 as vulnerable and the newly released versions as fixed.

CERT-EU described CVE-2026-109618 as a remote code execution vulnerability tied to memory corruption during out-of-memory error handling, with a CVSS score of 9.2. For CVE-2026-109619, it said the flaw also enables remote code execution and is linked to a stale global state, with the same CVSS score of 9.2.

What technical impact could they have?

Several firms outlined different but compatible exploitation scenarios. The Canadian Centre for Cyber Security advisory says both vulnerabilities could let a remote, unauthenticated actor run arbitrary code on an affected PHP system. AWS added that an unauthenticated attacker could send crafted web requests to execute arbitrary code, read data accessible to the process, or trigger a denial of service.

Red Hat said the flaws arise during PHP request processing and can lead to arbitrary code execution by a remote, unauthenticated attacker. Palo Alto Networks said CVE-2026-109618 is tied to use of longjmp() during out-of-memory errors, which can leave request memory uninitialized, while CVE-2026-109619 leaves global memory pointing to freed regions.

What recommendations did agencies and vendors give?

ENISA said both vulnerabilities could allow unauthenticated remote code execution on vulnerable PHP servers and recommended prioritizing internet-facing systems. When immediate patching is not possible, it advised isolating them from public networks.

AWS also said PHP branches 5.4 through 8.1 do not have a published upstream fix and require migration to a supported branch. New Zealand's NCSC recommended applying PHP's patches immediately and maintaining active monitoring for possible exploitation attempts.

Sophos reported that a proof-of-concept exploit related to the vulnerabilities had been published, but the available result does not confirm whether it is functional or being actively used. Check Point, meanwhile, published an independent advisory classifying the issue as a PHP remote code execution vulnerability and warning that a remote attacker could run arbitrary code on the affected system.