Two critical RCEs in PHP core

Cisco Talos disclosed two critical RCE vulnerabilities in PHP core, identified as CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on CVSS v4.0. CVE-2026-109618 occurs due to out-of-memory handling interrupting PHP during partial request data initialization, causing request cleanup to treat invalid data as valid. CVE-2026-109619 involves reuse of stale internal state after its backing memory has been freed before normal initialization. These vulnerabilities affect every PHP build since version 5.4 and can be exploited via a plain HTTP request before application code execution. The vulnerabilities impact a broad range of PHP-based applications and hosting environments. PHP 8.1 and older are unsupported and unpatched; PHP 8.2 support ends late 2026. Cisco Talos provides SNORT signatures for detection and recommends upgrading to fixed PHP releases. Mitigations include configuration changes such as setting memory_limit to -1 and adjusting upload limits for CVE-2026-109618, and disabling session.upload_progress and adjusting fatal_error_backtraces for CVE-2026-109619, though these do not fully mitigate the risk.

The vulnerabilities allow unauthenticated remote code execution in PHP core, potentially enabling attackers to execute arbitrary code on affected systems. The impact is widespread across the PHP ecosystem, affecting numerous popular applications and hosting platforms. Systems running unsupported PHP versions (8.1 and older) will not receive patches, increasing risk. Exploitation could be leveraged by state-sponsored, ransomware, and financially motivated threat actors. No active exploitation has been observed yet, but the potential blast radius is large due to PHP's extensive use.

A fix is available in supported PHP versions; users are strongly advised to upgrade to PHP 8.2 or later fixed releases immediately. There are no comprehensive temporary mitigations. For CVE-2026-109618, setting memory_limit=-1 in a way that applications cannot override and reducing post_max_size and upload_max_filesize may reduce exposure. For CVE-2026-109619, disabling session.upload_progress and setting fatal_error_backtraces=0 on PHP 8.5 can help reduce risk. These configuration changes do not fully mitigate the vulnerabilities. Cisco Talos provides SNORT signatures (67359 and 67360) for detection. Organizations should prioritize patching public-facing PHP systems promptly.