Critical PHP: two RCE flaws CVSS 9.2 and emergency patches

PHP in the crosshairs: two critical vulnerabilities allow unauthenticated RCE

The PHP Foundation has released emergency patches for two critical flaws affecting the most widely used server-side programming language on the Internet. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have a CVSS score of 9.2 and allow an unauthenticated remote attacker to execute arbitrary code on the server. The alert has caused some government websites in Europe, such as those in the Netherlands and Finland, to be taken offline as a precaution, and in Spain INCIBE-CERT has classified the situation as critical.

The first flaw, CVE-2026-109618, is caused by memory corruption during out-of-memory (OOM) handling, a situation that occurs when the system exhausts RAM and swap space. The second, CVE-2026-109619, allows remote code execution due to a stale global state that is reused in subsequent requests within the same worker. Both affect core PHP components, such as memory management and error handling, which makes them extremely severe and difficult to fix without compromising compatibility or performance.

Which versions are affected and how to protect yourself?

The PHP Foundation has released fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For the older branches 7.4, 8.0 and 8.1, backported source code patches have been published, although migrating to a maintained branch is recommended. Installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is especially high in mod_php, where an unauthenticated request can trigger the attack before the application code is executed.

INCIBE-CERT urges updating PHP immediately and warns that, although temporary measures exist to reduce exposure, updating is the only complete solution. If an Internet-exposed server cannot be updated, it is recommended to isolate it from public networks until the fix is applied. In addition, Linux and long-term support (LTS) vendors received the patches in advance, so organizations should check with their vendors about available fixes.

The impact is not limited to websites. PHP is embedded in appliances, network devices, management interfaces and other vendor products where administrators may not be able to update PHP directly. CERT-EU has also warned that many commercial and open-source products use PHP as a backend technology and could be affected even if they do not directly expose a PHP installation. This considerably expands the attack surface.

Recommendations for SMEs and IT teams

Faced with a vulnerability of this magnitude, the priority is to identify all systems running PHP and update them as soon as possible. It is not enough to check the corporate website; any application, API, administration panel or device that uses PHP as a backend must be located. To do so, we recommend:

• Inventory all PHP installations, including those that are part of appliances and third-party products.
• Update to the fixed versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or apply the backported patches if an older branch is used.
• Check with the vendor of hosting or LTS support to ensure that the fixes are applied.
• Isolate temporarily the Internet-exposed servers that cannot be updated.
• Review the configuration of mod_php and other modules, and consider additional mitigation measures such as web application firewalls (WAF) while the patches are applied.

Forrester analyst Madelein van der Hout notes that “what makes these vulnerabilities significant is their location” and that PHP underpins 70% of websites, which represents a huge concentration risk. “It is not enough to check only the corporate website. Organizations must determine where they are exposed and prioritize Internet-connected systems,” she adds. At ForgeNEX we share this view: the key lies in a proactive approach and in not underestimating the ubiquity of PHP in any SME's technology stack.

This incident is reminiscent of other recent critical flaws we have analyzed, such as the two RCE flaws CVSS 9.0 in Linux KSMBD, which also required rapid responses. The lesson is clear: maintaining an up-to-date inventory of components and an agile patch management process is essential to reduce the exposure window.

If you need help assessing your exposure or deploying the updates securely, at ForgeNEX we can help you. Do not wait for attackers to exploit the window of opportunity.

Source: Computerworld. Analysis and adaptation: ForgeNEX.