Critical Vulnerability in Broad Range of PHP Versions to be Patched 2026-10-21

Two vulnerabilities are due to be released by developers of the server scripting language PHP, which is foundational to a large portion of web technology on the internet. The following CVE tracking numbers were provided, although with limited technical information or confirmation of affected versions from the core developers.

CVE-2026-109618
CVE-2026-109619

Following the announcement and disclosure of the vulnerabilities’ severity, security researchers such as WatchTowr began to investigate and provide details on the upcoming patch.

This included that the vulnerabilities are remote code execution vulnerabilities with severe implications – remote code execution across a broad range of versions from PHP5 onwards. Given the technologies’ deployment in internet-facing applications, this presents high risk of remote exploitation. Notably, WatchTowr does not believe that the vulnerability is being exploited at the time of writing

The systems most at risk are all systems which make use of PHP. This is a diverse range of technologies including Wordpress, Joomla and Magento which are already known for being widely exploited.

At the time of writing, the upcoming release of the patch will create a race between threat actors and system administrators to apply the patch before exploits can be developed and deployed. Working proof-of-concept exploits are already reportedly available, and therefore some system administrators are reportedly taking websites down temporarily until the patch is released. 8.1 or below, will not receive the patch.

If you manage any system which uses PHP in your organisation’s environment, we recommend contacting Integrity360 for advice and support.

Update: Critical Vulnerability in Broad Range of PHP Versions to be Patched 2026-10-21

Two vulnerabilities were recently identified in PHP, a widely used server-side scripting language that forms a key component of many web applications. PHP has since released security updates to address these issues. The following CVE identifiers are associated with the vulnerabilities.

Information from the developers shows that the two vulnerabilities, listed respectively below, relate to out-of-memory corruption and stale global state vulnerabilities.

CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

The publication of the patch for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are, according to the developers, the only complete solution in mitigating the vulnerability. Linux distributions received the patches in advance, while older versions including PHP 8.1 and below will not receive the patch.

PHP Developers stated that “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” The systems most at risk are all systems which make use of PHP. This is a diverse range of technologies including Wordpress, Joomla and Magento which are already known for being widely exploited.

At the time of writing, the patch has been released, and website managers are now urged to update all installations urgently. Working proof-of-concept exploits are already reportedly available, and therefore some system administrators are reportedly taking websites down temporarily until the patch is released.

Organisations that are unable to apply the relevant PHP security updates immediately should consider temporarily taking affected Internet-facing applications offline until patching can be completed. Continuing to operate vulnerable systems may expose them to compromise, particularly where PHP is directly accessible by unauthenticated users.

Integrity360 will be monitoring the release of the patch and provide further insights as the release of this critical vulnerability unfolds.

If you manage any system which uses PHP in your organisation’s environment, we recommend contacting Integrity360 for advice and support.