PHP Security Release Addresses Critical RCEs

Security researchers reports that both vulnerabilities seems to be remote code execution (RCE) vulnerabilities. As no technical details are currently available for the vulnerabilities, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution, it is currently unknown which part of PHP is involved, whether it’s reachable over a plain web request, or whether it depends on a particular configuration.

This insight, since it was originally published, has been updated with new information regarding the vulnerabilities when the information has been released from the vendor. Take particular notice of the update notes.

❗UPDATE 21 Oct, 2026 16:00 UTC+1❗
According to the PHP Security Team, all PHP installations serving web requests are considered at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is considered highest for Apache mod_php deployments, where a demonstrated exploit can be triggered through an unauthenticated request before application code executes [1].

CVE-2026-109618 is an out-of-memory handling issue where PHP may be interrupted while internal request data is only partially initialized. During request cleanup, invalid data may be treated as valid, potentially resulting in remote code execution [1].

CVE-2026-109619 is caused by request-owned internal state persisting after its backing memory has been freed. Subsequent requests handled by the same worker may use stale state before normal initialization occurs, potentially resulting in remote code execution [1].

❗UPDATE 22 Oct, 2026 13:20 UTC+1❗
Truesec has conducted threat hunting for behavior related to vulnerability exploitation, see “Detection” for more information.

CVE

CVE-2026-109618
CVE-2026-109619

Affected Products

The impacted and fixed versions are not yet confirmed. Reporting suggests PHP versions 5 through 8 may be affected, and that only currently supported branches will get a fix. That would leave end-of-life PHP versions exposed with no patch at all[2].

❗UPDATE 21 Oct, 2026 16:00 UTC+1❗
PHP 8.5 prior to 8.5.12
PHP 8.4 prior to 8.4.27
PHP 8.3 prior to 8.3.36
PHP 8.2 prior to 8.2.35

Exploitation

A proof-of-concept (PoC) is available[3].

Recommended Actions

Truesec recommends the following:

• Inventory your PHP environments
• Plan for patching on Wednesday, 21 October 2026 at 14:00 UTC – note that this time could change.
• Identify any end-of-life PHP environments – If you’re running PHP 5, 7, or 8.0/8.1, you may not get a fix at all. This information is unknown until the vendor publishes an advisory.

According to security researchers, the flaws might be mitigated by (note that this is not confirmed)[3]:

• Applying session.upload_progress.enabled = Off in the configuration
• If you’ve got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don’t need uploads.

If immediate remediation is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix can be applied.

❗UPDATE 21 Oct, 2026 16:00 UTC+1❗
Truesec recommends that all customers running PHP update immediately to one of the following fixed versions [1]:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

Linux users should check with their operating system or LTS vendor for updated packages as several vendors received the patches in advance.

Organizations running PHP 8.1 or older should contact their operating system vendor regarding available backported security fixes or upgrade to a supported PHP version as soon as possible [1].

If immediate patching is not possible, the PHP Security Team recommends the following temporary mitigations for each vulnerability:

CVE-2026-109618 [1]:
Set memory_limit=-1 and ensure applications cannot override the setting.
Configure a low post_max_size.
Use container or cgroup limits as an availability boundary instead of RLIMIT_AS or RLIMIT_DATA.

CVE-2026-109619 [1]:
Set session.upload_progress.enabled=0 and restart all workers.
For PHP 8.5, set fatal_error_backtraces=0 and restart all workers.
Remove invalid or deprecated settings that emit diagnostics before initialization.
Fix attacker-reachable fatal errors and execution timeouts.

Detection

Due to limited information, no threat hunting is applicable at the moment. Truesec will only be able to identify vulnerable environments through the Managed Threat Exposure service.

❗UPDATE 22 Oct, 2026 13:20 UTC+1❗
Truesec threat hunted for signs of potential post-exploitation activity associated with web-server processes, including PHP-related processes, over the past 24 hours. The hunt focused on shell and scripting-interpreter execution with command-line indicators commonly associated with reconnaissance, downloading tools or payloads, and establishing reverse shells.

For Managed Threat Exposure customers, vulnerable assets have been identified. If your environment is affected, you will receive an Out-of-Cycle report.

References

[1] https://www.php.net/archive/2026.php#2026-10-20-1
[2] https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
[3] https://jackalsyn.com/posts/php-up-2026.html