Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are critical remote code execution vulnerabilities in PHP related to improper memory management during fatal error handling via longjmp(). CVE-2026-109618 allows attackers to achieve RCE by exploiting uninitialized request memory after out-of-memory conditions. CVE-2026-109619 enables RCE by exploiting global memory pointers referencing freed memory regions, which can be manipulated during subsequent requests. These vulnerabilities have a CVSS 4.0 base score of 9.2, indicating critical severity. Palo Alto Networks telemetry identified over 22.6 million potentially vulnerable exposed PHP instances. Protections are available via Palo Alto Networks security products including Cortex XDR, XSIAM, Cortex Xpanse, and Advanced Threat Prevention Plus with Frontier Virtual Patching. Immediate patching per the PHP Group’s advisory is strongly recommended.

Successful exploitation of these vulnerabilities allows remote attackers to execute arbitrary code on affected PHP servers, potentially leading to full system compromise. The vulnerabilities affect widely deployed PHP environments globally, increasing the risk surface. The presence of over 22.6 million exposed instances highlights the scale of potential impact. At least one government entity has taken its website offline as a precautionary measure, indicating the seriousness of the threat.

A security advisory from the PHP Group provides patching guidance; immediate application of these patches is strongly recommended. Palo Alto Networks customers can leverage protections available in Cortex XDR, XSIAM, Cortex Xpanse, and Advanced Threat Prevention Plus with Frontier Virtual Patching (signature 543004, available since October 20, 2026). Organizations should assess their exposure and apply vendor-provided patches without delay. No vendor advisory states that no action is required; therefore, patching is the primary mitigation.