PHP Critical Remote Code Execution Vulnerabilities

Urgent Customer Action: Block Reported IP Ranges

The following IP ranges have been reported as observed indicators of compromise (IOCs) in activity related to this advisory. Customers should block these ranges at their firewalls in line with their organisation’s controls and review logs for prior connections from these ranges.

• 45.153.34.0/24

• 45.156.87.0/24

• 85.11.167.0/24

• 87.121.84.0/24

• 91.92.40.0/24

• 91.92.42.0/24

• 91.92.47.0/24

• 93.152.221.0/24

• 94.26.106.0/24

• 176.65.132.0/24

• 185.245.62.0/24

• 185.245.63.0/24

• 192.109.200.0/24

• 94.154.43.219

• 213.152.161.54

• 135.136.51.37

• 185.14.29.28

This threat is ongoing and dynamic. These indicators may change or be incomplete. Please check this advisory regularly, as additional IOCs may be added.

Blocking these ranges is an additional precaution, not a substitute for applying the PHP security updates.

Overview

• Vendor: PHP.

• Overall severity: Critical, vendor-published CVSS v4.0 score 9.2 for each vulnerability.

• Advisory date: 22 October 2026.

• Vendor publication: Security updates and technical advisories published on 21 October 2026, following advance notice on 20 October 2026.

• CVEs: CVE-2026-109618 and CVE-2026-109619.

PHP has released fixes for two critical memory-safety vulnerabilities that can allow attackers to execute code remotely without authentication. The flaws involve out-of-memory handling and request-owned state that remains accessible after its memory has been freed.

The PHP Project identifies all PHP installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for Apache mod_php, where a demonstrated attack can run before application code begins. Exploitability varies by vulnerability, server interface, configuration and application behaviour. See the PHP security announcement.

Exploitation status: ASD’s ACSC states that it is not aware of active exploitation in its alert, last reviewed on 22 October 2026. However, the supplied BleepingComputer article includes a 21 October update reporting Cloudflare’s observation of early attacks. These reports differ in timing and attribution; neither should be interpreted as evidence that an unpatched installation is safe. Prioritise remediation based on the vendor’s confirmed remote code execution impact.

Scoring note: This advisory follows PHP’s official CVSS v4.0 9.2 rating for both vulnerabilities. Earlier third-party claims of a 10.0 score do not replace the vendor-published rating.

Affected Versions

The following supported-branch ranges apply to both CVEs. Use distribution or hosting-provider security guidance where fixes are backported rather than relying on the upstream version number alone.

PHP 8.5

• Affected: Releases before 8.5.12 in the 8.5 branch.

• Fixed: 8.5.12.

PHP 8.4

• Affected: Releases before 8.4.27 in the 8.4 branch.

• Fixed: 8.4.27.

PHP 8.3

• Affected: Releases before 8.3.36 in the 8.3 branch.

• Fixed: 8.3.36.

PHP 8.2

• Affected: Releases before 8.2.35 in the 8.2 branch.

• Fixed: 8.2.35.

• Lifecycle note: PHP 8.2 reaches end of life on 31 December 2026. Plan migration to a supported branch alongside immediate remediation.

Sources: PHP’s out-of-memory corruption advisory, stale global state advisory and security release announcement.

PHP 8.1 and older

PHP 8.1 and older no longer receive updates from the PHP Project. ASD’s ACSC states that versions from PHP 5 onwards may be affected; this is broader potential exposure, not a complete validated version matrix for every legacy branch.

PHP has provided minimal source-backports for PHP 7.4, 8.0 and 8.1 for organisations building from source or without an LTS vendor. Some Linux distributions and LTS providers supply backported fixes. Confirm coverage for both CVEs with the relevant provider, or migrate to a supported, patched release. Do not assume that an end-of-life installation is protected by ordinary upstream updates.

PHP 8.6 prerelease builds

PHP states that 8.6.0 RC4 contains both fixes and recommends updating earlier 8.6 test builds. This is a release candidate for testing, not a recommended production upgrade path.

Vulnerability Breakdown

CVE-2026-109618 - Remote code execution via out-of-memory corruption

• Severity: Critical.

• Vendor-published CVSS v4.0: 9.2.

• Description: An out-of-memory error can interrupt PHP while internal request memory is only partially initialised. Request shutdown may then process that invalid state, enabling memory corruption and remote code execution.

• Impact: Unauthenticated remote code execution with the web worker account’s privileges.

• Conditions: Attacker-controlled requests must reach a vulnerable allocation and cleanup path. PHP confirms complete remote code execution over HTTP against mod_php with default input and memory limits. The demonstrated request-startup path can occur before application code runs.

• Notes: PHP’s source analysis also identifies exposure in other server interfaces, with differing validation and application prerequisites. Its advisory does not demonstrate a complete PHP-FPM exploit for this specific CVE; that limitation does not establish that FPM is unaffected.

CVE-2026-109619 - Remote code execution via stale global state

• Severity: Critical.

• Vendor-published CVSS v4.0: 9.2.

• Description: A PHP worker can retain references to state owned by an earlier request after that request’s memory has been freed. A subsequent request handled by the same worker may access the stale state before normal initialisation resets it, causing a use-after-free.

• Impact: Unauthenticated memory disclosure and remote code execution with the web worker’s privileges.

• Conditions: Exploitation requires an operation that leaves request-owned state behind and a later operation that consumes it on the same worker. Fatal errors, certain diagnostics and session upload progress can contribute to these paths.

• Notes: PHP confirms a fatal-error-backtrace RCE path in mod_php and session lifecycle RCE in mod_php and PHP-FPM. Session upload progress is enabled by default and does not require an application call to session_start(). Other variants depend on application, extension and configuration behaviour.

Mitigation

Apply security updates immediately

• Upgrade supported PHP branches to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, as applicable, or a later release containing both fixes. Obtain packages from the PHP downloads page or the relevant distribution or hosting provider.

• Confirm provider backports. Linux distributions and LTS vendors received patches in advance. Check their security notices and package status rather than assuming an older-looking version string means a fix is absent.

• Address legacy installations. Confirm a supported provider remediation path or migrate from end-of-life PHP. Minimal source-backports do not restore normal upstream support.

• Verify deployment. Ensure the patched runtime is active across web-serving workers, containers and hosting environments, not only the command-line installation. Restart affected services as required by the deployment method.

The PHP Project states that updating is the only complete solution. Apply fixes for both vulnerabilities; addressing one does not resolve the other.

If immediate patching is not possible

The following vendor-documented measures reduce specific attack paths but do not make an unpatched installation safe. Review application and availability effects before applying them.

For CVE-2026-109618:

• Administratively enforce memory_limit=-1 so applications cannot restore a finite limit. PHP warns that underlying allocation failures can still reach the vulnerable path. Removing PHP’s per-request memory limit also requires careful availability controls.

• Keep post_max_size conservative: PHP suggests 8M where file uploads are unnecessary and 32M where they are required, with upload_max_filesize below that limit.

• Enforce decoded request-size and input-complexity limits at the web server or proxy, including requests without a usable Content-Length.

• If using container or cgroup memory boundaries, consider worker-level termination to reduce wider service disruption. Do not substitute RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable allocation-failure path.

For CVE-2026-109619:

• Set session.upload_progress.enabled=0 in configuration applied before request parsing and restart every worker. Do not rely on ini_set() or FPM .user.ini. This blocks confirmed session paths, not every variant.

• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal-backtrace path only.

• Remove invalid or deprecated per-request settings that emit diagnostics before initialisation. Suppressing messages with error_reporting, display_errors or @ does not prevent the vulnerable state access.

• Resolve attacker-reachable fatal errors and execution timeouts in application, extension and cleanup paths.

Use the PHP security announcement and both technical advisories for implementation details. WAF rules and configuration changes remain temporary risk-reduction measures, not substitutes for updating.

Monitor for suspicious activity

ASD’s ACSC recommends monitoring PHP applications and related systems for malicious activity. Review web server, PHP-FPM, proxy and service logs for unusual requests, worker failures and unexpected activity. PHP notes that relevant errors may not always be logged; an absence of warnings or failures is not proof of safety.

Summary for IT Teams

• Products: PHP web-serving installations, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Exposure depends on server interface and configuration; mod_php has the highest vendor-identified risk.

• Threat level: Critical. Both CVEs have a vendor-published CVSS v4.0 score of 9.2 and can allow unauthenticated remote code execution.

• Action required: Identify PHP across the environment, prioritise exposed web services, apply fixes for both CVEs, verify the active web runtime, and confirm remediation for legacy or provider-managed installations. Treat interim controls as incomplete and continue monitoring for suspicious activity.

Reference

Official vendor sources

• PHP security announcement and fixed releases.

• PHP advisory GHSA-w8hw-w9fx-j79w, CVE-2026-109618: RCE via OOM corruption.

• PHP advisory GHSA-6wmf-4rv5-p3rp, CVE-2026-109619: RCE via stale global state.

• PHP downloads.

Government and supplementary sources

• ASD’s ACSC: Critical vulnerabilities in PHP, last reviewed 22 October 2026.

• BleepingComputer: PHP warns admins of two critical flaws, including 21 October updates.

The ACSC alert and initial press report retain pre-release wording in places. This advisory uses PHP’s released technical advisories and fixed-version guidance for remediation, rather than treating patches as still pending.

Need Help?

If your organisation needs assistance assessing exposure, planning remediation or investigating potential compromise, contact the Secure ISS SOC team on 1300 769 460 or email soc@secure-iss.com.bersecurity posture.