Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution. CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is partially initialized, leading to request cleanup treating invalid data as valid. CVE-2026-109619 involves stale global state where request-owned internal state survives after memory is freed, allowing subsequent requests to use stale data before initialization. These affect PHP installations serving web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk on mod_php. Emergency updates were released for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Partial mitigations include configuration changes like disabling session.upload_progress and adjusting memory limits, but only updating fully resolves the issue. The PHP project also provided minimal backports for older versions and is preparing a full advisory for a related issue (CVE-2026-115560). Other significant cybersecurity incidents in October 2026 include supply chain compromises in LiteLLM, certificate authority compromise at eMudhra, and critical vulnerabilities in GitLab, with official advisories and responses published by respective vendors and organizations.

These vulnerabilities allow unauthenticated remote attackers to execute arbitrary code on affected PHP installations, potentially compromising web servers before any application code runs. The risk is highest for mod_php configurations, where exploitation has been demonstrated. This can lead to full server compromise, data theft, or further network intrusion. The vulnerabilities affect all PHP installations serving web requests across multiple PHP versions. Other related incidents in October 2026 include supply chain compromises and certificate authority breaches, which pose additional risks to trust and security in affected ecosystems.

A complete fix is available by updating PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. All users are strongly encouraged to update immediately. Partial mitigations include setting session.upload_progress.enabled=0, adjusting memory_limit to -1 to avoid controllable memory limit failures, setting low post_max_size and upload_max_filesize values, and enforcing request size limits at the server or proxy level. These mitigations reduce exposure but do not fully protect against exploitation. For older PHP versions (7.4, 8.0, 8.1), minimal backports are available from the PHP security team, but upgrading to supported versions is recommended. Users should monitor vendor advisories for further updates and the forthcoming advisory for CVE-2026-115560. No action is required beyond updating for other incidents mentioned, but users should consult official advisories for those separately.