PHP fixes CVE-2026-109618

The PHP team has released fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU, the Canadian Centre for Cyber Security, AWS, Google, Red Hat and ENISA all said the flaws are critical and could allow remote code execution on affected PHP systems, with earlier versions in those branches also exposed.

What did the new PHP versions fix?

The 8.5.12, 8.4.27, 8.3.36 and 8.2.35 releases include patches for both CVEs. The Canadian Centre for Cyber Security said earlier versions in those branches remain affected, while Google identified all PHP versions from 5.4 through 8.5.11 as vulnerable and the newly released versions as fixed.

CERT-EU described CVE-2026-109618 as a remote code execution vulnerability tied to memory corruption during out-of-memory error handling, with a CVSS score of 9.2. For CVE-2026-109619, it said the flaw also enables remote code execution and is linked to stale global state, with the same CVSS 9.2 score.

What technical impact could they have?

Several vendors described different but compatible exploitation scenarios. The Canadian Centre for Cyber Security’s advisory says both vulnerabilities could let a remote unauthenticated actor execute arbitrary code on an affected PHP system. AWS added that an unauthenticated attacker can send crafted web requests to execute arbitrary code, read data accessible to the process, or trigger a denial of service.

Red Hat said the flaws arise during PHP request processing and can lead to arbitrary code execution by a remote unauthenticated attacker. Palo Alto Networks said CVE-2026-109618 is tied to use of longjmp() during out-of-memory errors, which can leave request memory uninitialized, while CVE-2026-109619 leaves global memory pointing to freed regions.

What recommendations did agencies and vendors give?

ENISA said both vulnerabilities could allow remote code execution without authentication on vulnerable PHP servers and urged organizations to prioritize internet-facing systems. If patching is not immediately possible, it advised isolating them from public networks.

AWS also said PHP 5.4 through 8.1 branches do not have a published upstream fix and require migration to a supported branch. New Zealand’s NCSC recommended applying PHP’s patches immediately and maintaining active monitoring for possible exploitation attempts.

Sophos said a proof-of-concept exploit related to the vulnerabilities had been published, but the available result does not confirm whether it works or whether active exploitation is underway. Check Point, for its part, published an independent advisory classifying the issue as a PHP remote code execution vulnerability and warning that a remote attacker could execute arbitrary code on the affected system.

CVE-2026-109618 y CVE-2026-109619 in PHP, what was fixed?

PHP released fixes for CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws are critical and can allow remote code execution on affected PHP systems.

CERT-EU described CVE-2026-109618 as a remote code execution vulnerability associated with memory corruption during out-of-memory error handling, with CVSS 9.2. On CVE-2026-109619, it said the flaw also enables remote code execution and is linked to stale global state, with the same CVSS 9.2 score.

AWS, Google, Red Hat and ENISA agreed on the impact across earlier versions in those branches, while Google identified all PHP versions from 5.4 through 8.5.11 as vulnerable. AWS added that PHP 5.4 through 8.1 branches do not have a published upstream fix and require migration to a supported branch.

site.cisa.gov and CVE-2026-109618 in PHP

PHP fixed CVE-2026-109618 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaw is critical and can allow remote code execution on affected PHP systems.

CERT-EU described CVE-2026-109618 as a vulnerability tied to memory corruption during out-of-memory error handling, with a CVSS score of 9.2. Google identified all PHP versions from 5.4 through 8.5.11 as vulnerable, and AWS added that PHP 5.4 through 8.1 branches do not have a published upstream fix and require migration to a supported branch.