CVE-2026-109618 and CVE-2026-109619: Critical PHP Remote Code Execution Vulnerabilities

On October 21, 2026, PHP issued a security release for two critical vulnerabilities, including CVE-2026-109618, a CVSS 9.2 flaw that can lead to unauthenticated remote code execution by corrupting memory during out-of-memory conditions in internet-facing PHP installations that handle web requests. The risk applies to common setups such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed, and an attacker may be able to trigger the flaw before application code runs, putting PHP-based web applications and the servers behind them at risk.

If you maintain PHP for WordPress, another CMS, or custom web applications, this is an update you need to act on quickly. Below, we explain what CVE-2026-109618 does, which PHP versions were fixed in 8.2.35, 8.3.36, 8.4.27, and 8.5.12 and later, and what you can do right now to reduce exposure with upgrade guidance, ModSecurity rules, and Atomic Edge virtual patching while you work toward a full update.

Background

These vulnerabilities stem from PHP’s handling of out-of-memory (OOM) errors and stale global state in worker processes, and the October 21 security release rated CVE-2026-109618 high severity and CVE-2026-109619 critical:

• CVE-2026-109618 (OOM Corruption): When PHP, which powers many web applications, processes web requests in vulnerable deployments such as PHP-FPM, Apache mod_php, php-cgi, and similar setups, an unauthenticated request from an unauthenticated remote attacker can trigger the flaw before application code runs. During request initialization, request data may be left partially built after a fatal error, causing request cleanup to treat invalid data as valid and free memory that was never safely initialized. That can expose attacker-controlled contents from earlier allocations and cause memory corruption exploitable for remote code execution.
• CVE-2026-109619 (Stale Global State): In long-running PHP installations, stale technical details matter because a request handled by a PHP worker can leave global state pointing at freed backing memory. A later request on the same worker may reuse that state before application code resets it, creating a use-after-free condition that can lead to information leaks and remote code execution.

Because these are memory-safety bugs triggered by memory pressure, no simple HTTP signature exists for WAFs to reliably block exploits.

ModSecurity Mitigation Rules

While patching PHP is the only complete fix, defense-in-depth mitigations help reduce exposure. These are the technical details behind the two critical vulnerabilities. Atomic Edge provides ModSecurity rules to harden request handling:

SecRequestBodyAccess On
SecRequestBodyLimit 10485760  # 10 MiB limit
SecRequestBodyInMemoryLimit 131072  # 128 KiB in-memory buffer
SecRequestBodyLimitAction Reject

SecRule REQBODY_ERROR "!@eq 0" 
    "id:9100001,phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.'"

SecRule MULTIPART_STRICT_ERROR "!@eq 0" 
    "id:9100002,phase:2,t:none,log,deny,status:400,msg:'Multipart request body failed strict validation.'"

SecRule REQUEST_METHOD "@streq POST" 
    "id:9100010,phase:1,t:none,pass,nolog,chain"
    SecRule REQUEST_HEADERS:Content-Type "@rx ^multipart/form-data" 
        "t:none,t:lowercase,deny,status:415,msg:'Multipart POST blocked (no uploads expected)'
"

These rules limit request body size, reject malformed multipart data, and block multipart POST requests where uploads are not expected. Used at the web server layer, they can reduce exposure on specific attack paths as temporary mitigations, but they do not make an unpatched installation safe. Blocking multipart/form-data can also break file uploads, so test critical flows and remove the rule after updating. Older PHP versions 5 through 8.1 are affected, and PHP 8.1 and earlier are no longer supported and do not receive official patches.

Atomic Edge Virtual Patching

Atomic Edge applies CVE-aware virtual patching to reduce risk from exploits targeting these vulnerabilities. Our platform enforces strict request size limits, multipart validation, and rate limiting at the edge, filtering malicious traffic before it reaches PHP. If patching cannot happen immediately, a web server can temporarily block multipart/form-data handling or restrict exposed methods, but these are temporary mitigations only. While these measures do not replace patching, they provide crucial defense-in-depth during the upgrade window until the upcoming security release or a PHP update is installed.

# Example temporary mitigation
<LimitExcept GET POST HEAD>
  Require all denied
</LimitExcept>

If you block multipart requests, remember that it can break file uploads and similar form workflows, so use the rule only where uploads are not needed. These controls reduce exposure to specific attack paths but do not make an unpatched installation safe. For complete remediation, PHP users should move to a supported version and check vendor advisories from the PHP security team if they rely on Linux distributions or distribution packages for updated packages and fixed versions. If you build from source, review published minimal source backports and other minimal source backports where available. For emergency risk reduction, you can temporarily set memory_limit=-1 and disable session.upload_progress.enabled. Where feasible, take the store offline or switch it to read-only mode until PHP is updated.

Proof of Concept

A non-exploit proof-of-concept demonstrates the improved OOM handling in patched PHP versions. If you run PHP in production, virtual patching can buy time until the upcoming security release or a PHP update is available, and a temporary availability boundary such as a cgroup memory limit may help constrain memory exhaustion, but it is only a stopgap. It triggers an out-of-memory condition and shows that PHP now raises a catchable error without corrupting internal state:

< ?php
ini_set('memory_limit', '10M');

function allocate_until_oom(): void {
    $buf = [];
    while (true) {
        $buf[] = str_repeat('A', 1 < <  20); // Allocate 1 MiB repeatedly
    }
}

try {
    allocate_until_oom();
    echo "UNEXPECTED: no OOM triggeredn";
} catch (Throwable $e) {
    echo "Caught ", get_class($e), ": ", $e->getMessage(), "n";
}

echo "Post-OOM cleanup reached cleanlyn";
?>

This code illustrates that patched PHP versions unwind OOM errors safely, unlike vulnerable versions that leave inconsistent state. The only durable remediation is to move to a supported version and update to the fixed releases; if PHP comes from a Linux distribution or other distribution packages, check the vendor advisories for updated packages. The PHP security team also published minimal source backports for older branches, mainly for users who build PHP from source. If no update is immediately available, temporarily isolate internet-facing applications from public networks. After patching, verify PHP-FPM and Apache remediation and audit logs for unusual traffic patterns.

Summary

• CVE-2026-109618 and CVE-2026-109619 are critical memory-safety vulnerabilities in PHP enabling unauthenticated remote code execution.
• They arise from PHP’s OOM bailout and stale global state in worker processes.
• The only complete fix is upgrading PHP to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and later.
• Some teams temporarily enforce an availability boundary, such as a container or cgroup memory limit, to constrain memory exhaustion while waiting to patch.
• Atomic Edge provides ModSecurity rules and virtual patching to reduce risk during the upgrade process.
• No WAF can fully block these exploits due to their memory-safety nature.
• Check the vendor advisory for affected versions, especially if you still run PHP 8.1 or earlier on unsupported branches.
• The PHP Project published the fixes, while the php foundation explained why the release timeline moved up after early disclosure.
• Reports on hacker news and social posts circulated the identifiers before the formal advisory.
• More than one security researcher has warned that large numbers of internet-facing hosts could remain exposed until updates are widely deployed.
• If patched builds are not yet available in your usual php packages, use your distribution’s maintained packages, build from source, or ask your host to apply the update.

Upgrade PHP promptly and use defense-in-depth measures like Atomic Edge to protect your sites in the interim; a cgroup memory limit is only a stopgap and does not replace upgrading PHP.