Critical PHP vulnerabilities allow unauthenticated remote code execution

PHP maintainers have patched two critical vulnerabilities that enable unauthenticated remote code execution (RCE). The flaws affect various deployment methods including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Users are urged to update their installations immediately to mitigate the risk.

Technical details of the PHP RCE vulnerabilities

• CVE-2026-109618: An out-of-memory (OOM) handling error can interrupt PHP while internal request data is only partially initialized, causing request cleanup to treat invalid data as valid.
• CVE-2026-109619: A stale global state vulnerability where request-owned internal state survives after its backing memory is freed, allowing a subsequent request on the same worker to use that state.
• The risk is highest for mod_php installations, where exploits can be triggered before any application code executes.

Why it matters

Since PHP powers a vast portion of the web, these RCE vulnerabilities pose a significant threat to web servers and cloud-native applications using PHP-based stacks.