PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

What it is

Two critical unauthenticated remote code execution bugs in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The PHP project fixed them on 21 October 2026 at 14:00 UTC in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because they sit in the interpreter, not in a Composer package, dependency manifests will not show them. The page is a Snyk vendor post, and it ends with Snyk product material.

How it works

Both flaws are in the engine's request lifecycle, so they are reachable before any application code runs.

• CVE-2026-109618 (out-of-memory corruption): an out-of-memory interrupt can stop PHP while internal request data is only partly initialized. Request cleanup then treats that data as valid. An attacker needs to push a worker to its memory limit with a malicious request.
• CVE-2026-109619 (stale global state): request-owned internal state survives after its backing memory is freed. A later request on the same worker can use it before normal initialization resets it. In a long-lived worker model this is a cross-request use-after-free.

Preconditions / Affected

• Any PHP installation serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed.
• Apache with mod_php is the most exposed. The page says an exploit has been demonstrated in which a single unauthenticated request triggers the attack before application code runs.
• PHP 8.1, 8.0 and 7.4 get no upstream fix and are affected.

What to do

1. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
2. Pull patched packages from your distribution or LTS vendor. A patched distro build can keep an older version number, so check the distro advisory or patch level, not just the version string.
3. Verify what is actually running on each host and image with php -v or the image tag. Scan results alone cannot confirm a fix.
4. On 8.1 or older, upgrade or get a vendor backport. The PHP security team also published minimal source backports for 7.4, 8.0 and 8.1, which the page frames as a last resort for teams building from source.
5. On 8.2, note that it reaches end of life on 31 December 2026, so plan the next upgrade.
6. If you cannot update today, PHP lists these mitigations: - memory_limit=-1, set where applications cannot override it - a low post_max_size - session.upload_progress.enabled=0, followed by a restart of every worker - fatal_error_backtraces=0 on 8.5

To find hosts, Snyk API & Web has a Discovery tab with a Tech filter set to PHP. It lists hosts where PHP was fingerprinted, but it does not report versions.

Caveats

The PHP security team states: "There are no complete mitigations; updating is the only safe choice." The settings above reduce exposure on specific paths and do not make an install safe, and the page defers to the PHP advisory for the caveats on each. The remirepo RPM repository (rpms.remirepo.net) was not updated on day one. The page does not give exploit details, the root-cause code, or affected version ranges below the fixed releases. Snyk SCA does not detect the issue from composer.json or composer.lock, since the interpreter is not a declared dependency. Snyk advisories are SNYK-UNMANAGED-PHP-21347795 (CVE-2026-109618) and SNYK-UNMANAGED-PHP-21347796 (CVE-2026-109619), and its Zero Day report covers Unmanaged and Container projects.