Security Through Openness: Why Defenders Share What Attackers Already Know

Critical Vulnerabilities in PHP (October 2026)

Based on official alerts from the Australian Cyber Security Centre (ASD's ACSC), the PHP Group, and the National Vulnerability Database (NIST NVD), a critical security release was published on October 21–22, 2026, addressing a pair of severe unauthenticated Remote Code Execution (RCE) vulnerabilities.

Overview of the Vulnerabilities

The advisory covers two distinct, critical vulnerabilities affecting PHP web application setups (including popular interfaces like PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed):

RCE via OOM Corruption — CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)
Handlers for out-of-memory (OOM) conditions can interrupt PHP execution while internal request data is only partially initialized. During request cleanup, the engine can mistakenly treat this invalid or partial data as valid, resulting in memory corruption and remote code execution.
RCE via Stale Global State — CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)
PHP maintains various global states that temporarily point into request-owned memory. Under certain scenarios, this global state is not correctly reset (or gets repopulated after being reset), leaving it pointing to backing memory that has already been freed. A subsequent request handled by the same worker can read or branch on this stale state before normal initialization occurs, leading to a Use-After-Free (CWE-416) and unauthenticated RCE.

CVSS Severity: Both vulnerabilities carry a critical base score of 9.2 (CVSS v4.0).

Affected Versions

PHP 8.2: All versions prior to 8.2.35 (Note: PHP 8.2 reaches its official end-of-life on December 31, 2026)
PHP 8.3: All versions prior to 8.3.36
PHP 8.4: All versions prior to 8.4.27
PHP 8.5: All versions prior to 8.5.12

Older, unsupported versions like PHP 8.1 and below may also be affected, though they receive no official updates outside of minimal source-backports provided for manual builds/LTS vendors.

Recommended Remediation and Mitigations

According to the PHP Group and the ACSC, there are no complete application-level mitigations—updating the software is the only definitive solution.

Immediate Patching: Upgrade your environment to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 depending on your active branch. Linux distributions and LTS vendors should have packages ready or backported.
Temporary Workarounds (If patching is delayed):
- For CVE-2026-109618 (OOM): Set memory_limit = -1 (to prevent memory limit failure exceptions from triggering the path) and lower post_max_size (e.g., to 8M or 32M) via php_admin_value configurations.
- For CVE-2026-109619 (Stale State): Set session.upload_progress.enabled = 0 and restart workers, and on PHP 8.5 set fatal_error_backtraces = 0.

References

For further technical details, consult the PHP Security Advisory Archive and the NIST CVE-2026-109619 Entry. Cybersecurity Resources. Defending against attackers exploiting known vulnerabilities