A recently disclosed set of critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affects PHP and may allow an unauthenticated remote attacker to execute arbitrary code on vulnerable web servers. Security updates are now available, and administrators are strongly encouraged to apply the applicable updates immediately.
Severity level:
CVSS Score: 9.2 / Critical
Description:
CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities affecting PHP. The vulnerabilities can result in memory corruption and, under certain conditions, may be exploited to achieve unauthenticated remote code execution on affected PHP systems.
The vulnerabilities are identified as:
- CVE-2026-109618: RCE via RFC 1867 input parsing OOM
- CVE-2026-109619: RCE via global state corruption after fatal error
Affected Versions:
PHP version 5 and onwards are affected. Administrators should not limit their assessment to older PHP installations and should identify PHP installations across their environments, prioritizing internet-facing systems. Organizations running older PHP versions are strongly encouraged to upgrade to a fully supported version.
Impact:
Successful exploitation may allow an unauthenticated attacker to execute arbitrary code on an affected PHP server, potentially resulting in compromise of the affected server and the applications and information it hosts.
Recommendation:
Apply the applicable PHP security update immediately and upgrade to the latest fixed version of PHP. Priority should be given to internet-facing PHP systems and services.
Administrators should also identify third-party products, appliances, or services that may include PHP as an underlying component and monitor those vendors for applicable security updates.
Where an affected system cannot be updated immediately, apply the temporary mitigations provided by the PHP Team. If the system cannot be updated or adequately mitigated in a timely manner, contact the Information Security Office at infosec@yorku.ca and consideration should be given to taking the system offline until it can be fully mitigated.
There are reports of early attempts to exploit the vulnerabilities, although confirmed compromise was not established in the reporting reviewed. This reinforces the need to minimize the time between identification of an affected system and patching or mitigation.Reference:
PHP Official Website
The Hacker News – PHP2Shell
Cyber Security News – PHP Critical Vulnerabilities
UIT Information Security