SECURITY ADVISORY ON CRITICAL PHP REMOTE CODE EXECUTION VULNERABILITIES

Advisory ID:   ngCERT-2026-100019

Damage:      Critical 

Probability:  High

Platform(s):  PHP web-request processing deployments (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed)

SUMMARY

ngCERT alerts of two critical Remote Code Execution (RCE) vulnerabilities affecting PHP installations that process web requests. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, which allow an unauthenticated remote attacker to execute code on a vulnerable server under affected conditions. The Developers published security releases on 21 October 2026 and strongly advise users to update immediately. The vulnerabilities have been assigned a CVSS v4.0 score of 9.2 out of 10. The issues affect web-serving deployments including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. MDAs, financial institutions, telecommunications providers, internet service providers, web hosting companies, private-sector organisations and website administrators should urgently identify exposed systems, install vendor-provided security updates, and investigate suspicious activity.

DESCRIPTION

CVE-2026-109618 concerns RCE associated with out-of-memory handling. The PHP security advisory explains that memory-allocation failure can interrupt processing while internal request data is only partially initialised, after which request clean-up may incorrectly process invalid data. CVE-2026-109619 concerns RCE arising from stale internal global state allowing a later request handled by the same worker to use stale state before normal initialisation resets it. The PHP team states that the risk is highest for Apache deployments using mod_php, where a demonstrated unauthenticated request can trigger the attack before application code runs. The official fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported directly by the PHP project; administrators should consult their operating-system or long-term-support vendor for verified backported fixes or migrate to a supported branch.

CONSEQUENCES

Successful exploitation could result in:

    1. Remote code execution.
    2. Server and application compromise.
    3. Unauthorised access to sensitive information.
    4. Database compromise.
    5. Service disruption.
    6. Malware deployment and persistence.
    7. Lateral movement.e
    8. Financial, legal and reputational damage.
    9. Supply-chain and downstream impact. 

SOLUTION/MITIGATION

ngCERT strongly recommends the following:

    1. Identify and inventory all PHP assets.
    2. Immediately apply security updates to fixed PHP versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35), as applicable. For PHP 8.1 and older, apply verified vendor backports or migrate to a supported branch.
    3. Isolate systems that cannot be patched promptly.
    4. Implement Temporary Risk-Reduction Measures
    5. Monitor for indicators of compromise.
    6. If compromise is suspected, isolate affected systems, preserve forensic evidence, activate incident response and rotate potentially exposed credentials.
    7. Coordinate remediation with hosting providers and application vendors and report significant incidents to ngCERT.  

HYPERLINK