Critical security issue affecting PHP

Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) involve improper handling of out-of-memory conditions leading to memory corruption. CVE-2026-109618 occurs when PHP is interrupted while internal request data is partially initialized, causing request cleanup to treat invalid data as valid. CVE-2026-109619 involves request-owned internal state surviving after its backing memory is freed, potentially allowing stale state use in subsequent requests. These flaws can be exploited to achieve unauthenticated remote code execution on affected web servers. The PHP Foundation has released a security update fixing these issues, and temporary mitigations are available for those unable to update immediately.

Successful exploitation of these vulnerabilities can lead to unauthenticated remote code execution on web servers running PHP, potentially allowing attackers to execute arbitrary commands. This poses a critical risk to the confidentiality, integrity, and availability of affected systems. The vulnerabilities affect all PHP versions, increasing the scope of potential impact across diverse environments.

A security update fixing these vulnerabilities has been released by the PHP Foundation. Organisations are strongly advised to update to the latest PHP version containing the fix. If immediate update is not feasible, temporary mitigations provided by the PHP Foundation should be applied. Systems that cannot be updated or mitigated promptly should be taken offline until remediation is possible. Organisations should identify all PHP installations, prioritize internet-facing systems for remediation, and monitor for further updates. Additionally, assess systems for signs of compromise if remediation is delayed, and seek assistance from NCSC-assured Cyber Incident Response providers if needed.