PHP released emergency security updates on October 21, 2026, fixing two critical vulnerabilities that can permit unauthenticated remote code execution. The PHP security team says all installations serving web requests are at risk, with Apache mod_php facing the highest risk. The release covers PHP-FPM, php-cgi, FrankenPHP and LiteSpeed deployments as well.

The PHP Foundation says the release was brought forward from October 22 after the CVE identifiers circulated publicly. Both flaws carry CVSS v4.0 scores of 9.2. The foundation says its team examined circulating proof-of-concept code but had not identified functional exploits among those samples at disclosure time; that finding does not establish whether attacks have occurred.

According to the PHP project advisory, CVE-2026-109618 involves out-of-memory handling that leaves internal request data partially initialized. Cleanup can then process invalid memory. Researchers demonstrated remote code execution against Apache mod_php under default PHP limits, before application code runs, with commands executing as the web worker account.

The separate advisory for CVE-2026-109619 describes internal state that survives after request memory is freed. A subsequent request handled by the same worker can access that stale state before initialization resets it, causing a use-after-free. Exploitability depends on the application, configuration and affected internal state; a crafted memory layout can enable remote code execution.

The disruption reached internet governance infrastructure. ICANN said it temporarily disabled three PHP-based administrative websites as a precaution, with no indication its systems had been negatively affected. In an October 22 update, ICANN said those sites were available again after it applied and tested the patch.

The PHP team directs administrators to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or obtain patched packages from their distribution or support vendor. Older installations require a supported upgrade or applicable vendor fixes. The team warns that configuration workarounds address only particular attack paths and cannot replace an update.

The UK National Cyber Security Centre urges organisations to inventory PHP across their infrastructure, prioritise internet-facing systems and monitor them for malicious activity. Its guidance also calls for tracking updates to third-party products that bundle PHP and considering taking systems offline when immediate remediation is not feasible.