PHP’s Critical RCE Crisis: What You Need to Know and Do Now

The PHP project has released emergency patches for two critical vulnerabilities that allow unauthenticated remote code execution (RCE) . If you run PHP in production, this is not a drill — update immediately.

The Two Flaws

Both vulnerabilities carry a CVSS score of 9.2 and affect the PHP core itself, meaning exploitation can occur before any application code even runs.

CVE-2026-109618 – RCE via OOM memory corruption. PHP’s memory-limit enforcement can interrupt request processing while internal data is only partially initialized. When the request is cleaned up, that malformed data is treated as valid, and an attacker can leverage the resulting memory corruption for code execution.

CVE-2026-109619 – RCE via stale global state. Request-owned internal state can survive after its backing memory is freed (for example, after a fatal error). A later request handled by the same worker may use that stale state before normal initialization resets it, opening another path to RCE.

Who Is at Risk

Every PHP installation serving web requests is potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP team considers mod_php the highest-risk configuration, with a demonstrated exploit that works via a single unauthenticated request.

Affected and Fixed Versions

Affected branch	Fixed version
PHP 8.5.x < 8.5.12	8.5.12
PHP 8.4.x < 8.4.27	8.4.27
PHP 8.3.x < 8.3.36	8.3.36
PHP 8.2.x < 8.2.35	8.2.35

PHP 8.1 and older are end-of-life and no longer receive official updates. The PHP security team has published minimal source backports for PHP 7.4, 8.0, and 8.1 for those who build from source.

What to Do Right Now

1. Patch first. Upgrade to the fixed version for your branch. Linux distributions and LTS vendors received patches in advance — check your vendor’s repositories.
2. If you cannot patch immediately, apply the following mitigations — but understand they reduce exposure, not eliminate risk:
   • Set memory_limit=-1 in a way applications cannot override (e.g., php_admin_value in FPM pool or Apache config). This removes the controllable OOM failure path for CVE-2026-109618.
   • Lower post_max_size (8M if no file uploads are needed, 32M otherwise) and keep upload_max_filesize below it.
   • Disable session.upload_progress.enabled and restart all workers. This blocks the confirmed session-related attack path for CVE-2026-109619.
3. Isolate internet-facing PHP applications from public networks until a fix is applied and verified, if patching is not immediately feasible.

The Bottom Line

Proof-of-concept exploits are already circulating, and attackers are likely to move quickly. PHP powers a massive share of the web — this is a patch-now situation, not a schedule-for-next-sprint one. Verify your PHP version, update, and confirm the fix is live.