Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities. watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging. The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version numbers reported before the release point to PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches are not expected to receive fixes. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two critical vulnerabilities in PHP that were announced on October 20, 2026. FAQ When were these PHP vulnerabilities first disclosed? On October 20, 2026, the CVE identifiers circulated on Hacker News and social media. Later that day, the PHP security team published an advance notice of a security release scheduled for October 21 at 14:00 UTC (10:00 AM ET) to address two critical vulnerabilities. The notice said the team could release earlier if details became public or if exploitation appeared in the wild. CERT-EU also published an advisory (2026-018) naming both CVEs. According to watchTowr , the vulnerabilities were originally set to be disclosed on Thursday, October 22, under embargo. A video shared by researcher Kirill Firsov demonstrates the exploit chain, dubbed php2shell. Firsov credited the video and exploit to researcher LCFR and Calif.io. The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence. — The PHP Foundation (@ThePHPF) October 20, 2026 What are CVE-2026-109618 and CVE-2026-109619? CVE Description CVSSv4.0 CVE-2026-109618 Unspecified PHP Vulnerability 9.2 CVE-2026-109619 Unspecified PHP Vulnerability 9.2 CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. Public reporting describes both as remote code execution vulnerabilities. The PHP security team has not published technical details before the patch release. CVSS scores differ across sources. The PHP security team rates both vulnerabilities as CVSSv4.0 9.2. Some early reports, including watchTowr and a Hacker News post, describe them as CVSS 10.0. We will update this blog once PHP publishes its advisory. Which PHP versions are affected? CERT-EU says these vulnerabilities could affect all PHP versions from PHP 5 onwards, and the demonstration video references PHP 5.4.0 and later. PHP will publish the official list of affected and fixed versions with the release. Before the release, security researcher Kevin Beaumont reported the following fixed versions: Affected Versions Fixed Version (expected) PHP 8.5.x 8.5.12 PHP 8.4.x 8.4.27 PHP 8.3.x 8.3.36 PHP 8.2.x 8.2.35 PHP 5.x through 8.1.x End-of-life, no fix expected Linux distributions that ship older PHP packages may backport fixes, so organizations using distribution packages should check their vendor's advisories. How widespread is PHP, and how many hosts are potentially affected? According to W3Techs , PHP is used by 69.3% of websites whose server-side language is known. Platforms such as WordPress, Drupal, Joomla, Laravel and Magento all run on PHP. Security researcher Silas Cutler's rough estimate is that over 1.3 million internet-exposed hosts are potentially vulnerable. A Shodan search by Henk Poley counts over 1.9 million internet-exposed hosts running PHP. Has exploitation been observed in the wild? On October 21, Cloudflare CTO Dane Knecht said the company is "seeing early attacks emerging" and is updating its miti…
CVE-2026-92388 is a critical use-after-free vulnerability in curl's FTP wildcard LIST operation handling. When such an operation fails, internal state corruption can occur, leading to crashes or memory corruption when the affected easy handle or its clone is reused. This can cause heap use-after-free reads or type confusion, potentially allowing attackers to manipulate memory during server responses.
CVE-2026-94192 is a use-after-free vulnerability in the Eclipse Foundation's Eclipse ThreadX kernel module. The vulnerability arises because the Module Manager's object pool deallocates memory for kernel object control blocks without properly removing them from internal kernel lists, leaving kernel objects in an inconsistent state. This can lead to the reuse of freed memory while the kernel still references it, potentially causing undefined behavior or system compromise. The affected versions are from 6.0.1 up to and including 6.5.1.202602a. The vulnerability has a high severity score of 8.5.
CVE-2026-112402 is a high-severity double free vulnerability in the python-pillow Pillow library affecting versions prior to 13.0.0. The flaw occurs in the ImagingScaleAffine function during Image.transform() when a memory allocation for a lookup table fails, leading to a double free of the output image's memory. This causes a crash (SIGSEGV) and heap corruption in processes with memory limits or 32-bit environments. The vulnerability has been present since Pillow 1.0 and is fixed in version 13.0.0.
A use-after-free vulnerability exists in the python-pillow Pillow library when saving images as TIFF to an in-memory buffer. If libtiff rejects a tag during encoding, the encoder frees its output buffer but leaves the TIFF handle open. Later, during cleanup, a write occurs into the freed buffer, causing a crash and potential memory corruption. This affects Pillow versions from 11.3.0 up to but not including 13.0.0. The issue can lead to denial of service or potentially remote code execution when processing attacker-influenced images.
CVE-2026-110686 is a use-after-free vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl. The flaw occurs when filter callbacks remove themselves during JSON decoding, leading to use of freed memory and potential process crashes. This issue is fixed in version 4.80.
CVE-2026-110681 is a use-after-free vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl. The flaw arises when a parser object is cloned into a new interpreter thread, causing the child thread to use and free scalar pointers that belong to the parent thread. This can lead to calling freed callbacks, corrupting reference counts, and crashing the process.
CVE-2026-110753 is a critical use-after-free vulnerability in Text::CSV_XS for Perl affecting versions from 1.46 up to but not including 1.65. The flaw occurs when the skip_empty_rows option causes the parser to free a scalar variable that is still referenced by the application, leading to use of freed memory and potential process crashes.
CVE-2026-17591 is a use-after-free vulnerability in libarchive affecting Red Hat Hardened Images. The flaw occurs in the archive_entry_copy_mac_metadata() function, where an internal buffer is deallocated before completing a data copy. This can lead to a Denial of Service (application crash) or potential information disclosure by reading uninitialized memory. Exploitation requires highly specific application-level API usage that is uncommon in standard archive utilities. Red Hat rates this vulnerability as low severity due to its limited exposure and impact in typical environments. A security update addressing this issue is available for Red Hat Hardened Images.
A use-after-free vulnerability (CWE-416) exists in MariaDB server versions 12.3.1 through before 12.3.3 and 13.0.1 through before 13.0.2 in the handling of SYS_REFCURSOR. This flaw allows a low-privileged attacker to open many SYS_REFCURSORs and trigger a use-after-free condition, potentially enabling remote code execution when combined with another vulnerability. The issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-58099 is a race condition vulnerability in FreeBSD affecting the copying of knotes from a parent kqueue to a child. The flaw arises because marker knotes, which track list traversal positions internally, were not properly excluded before being marked as in-flux and releasing the kqueue lock. This can lead to use-after-free conditions if another thread frees a marker while the lock is dropped. An unprivileged local user could exploit this to escalate privileges on the system.
CVE-2026-101970 is a Use After Free vulnerability in the rpd PIM Join/Prune processing component of Juniper Networks Junos OS and Junos OS Evolved platforms. This flaw allows an unauthenticated adjacent attacker to crash the routing daemon by sending specific PIM messages when sparse mode PIM is configured. The vulnerability has a medium severity with a CVSS score of 6.5 and impacts multiple versions of Junos OS and Junos OS Evolved as specified. There is no explicit patch or remediation information provided in the input data.
CVE-2026-102078 is a Use After Free vulnerability in the packet forwarding engine of Juniper Networks Junos OS on SRX Series devices. It can be triggered by an unauthenticated, network-based attacker when web filtering for TCP traffic is enabled and a high volume of DNS requests occurs. This causes a race condition that leads to a flowd process crash and restart, resulting in a temporary Denial-of-Service (DoS) until automatic recovery. The vulnerability affects multiple Junos OS versions prior to specific fixed releases. A patch is available to address this issue.
CVE-2026-97205 is a Use-After-Free vulnerability in the ngx_http_core_module of NGINX Plus and NGINX Open Source. It occurs when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page with "include virtual" commands is processed. This can cause memory corruption, worker process crashes, or potentially remote code execution on systems without ASLR or where ASLR is bypassed. The vulnerability affects specific versions of NGINX Plus and Open Source as listed. It is a high severity issue with a CVSS score of 8.1. There is no control plane exposure; the issue is limited to the data plane. No patch links are provided in the data, and the vendor advisory status is not explicitly stated.
CVE-2026-92392 is a use-after-free vulnerability in curl that occurs during an HTTP/2 upload when the server sends an RST_STREAM frame with reason HTTP_1_1_REQUIRED or REFUSED_STREAM. This mishandling leads to a use-after-free of a Curl_easy object, potentially allowing an attacker to cause a crash or execute arbitrary code.
CVE-2026-94370 is a medium severity vulnerability in Qt for MCUs versions 2.12.1 and 2.12.2. It involves a double free condition caused by improper handling of string memory ownership when converting std::string text passed into Qt Quick Ultralite. This can lead to heap memory corruption including double free, invalid free, or use-after-free errors.
CVE-2026-50217 is a use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent. It allows a local low-privileged user to cause a denial of service (system crash or BSOD) by sending an outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the IPv6 ICMP redirect policy is enabled. The vulnerability arises because a buffer containing the packet is freed but still passed to a downstream filter, with the size of the freed allocation attacker-controlled. Exploitation requires the non-default IPv6 ICMP capture/redirect policy to be active on the endpoint. A patch is available for affected versions.