Two Critical RCE Vulnerabilities Found in PHP Core

Summary Points

1. Two critical PHP-core flaws enable unauthenticated RCE through a plain HTTP request, before application code runs.
2. The flaws affect PHP builds dating back to 5.4, putting applications across the PHP ecosystem at risk.
3. About half of PHP systems may lack a patch; PHP 8.1 and older are EOL. No in-the-wild exploitation was observed as of Oct. 21, 2026.

Threat, Attack Techniques, and Targets

Cisco Talos tracks two critical, unauthenticated remote code execution flaws in PHP core: CVE-2026-109618 and CVE-2026-109619. Both have a CVSS v4.0 score of 9.2. Attackers can trigger them with a plain HTTP request before application code runs. One flaw involves memory handling during an out of memory event. The other involves reuse of stale internal state.

The flaws affect PHP builds dating back to version 5.4. Therefore, PHP applications such as WordPress, Drupal, Magento, Shopware, WooCommerce, and Laravel may face exposure. PHP sites hosted through cPanel or Plesk may also face risk. Talos says state sponsored groups, ransomware groups, and other financially motivated actors use RCE techniques. However, Talos had not observed exploitation in the wild as of October 21, 2026.

Impact, Security Implications, and Remediation

Because the flaws affect PHP core, organizations across all industries that run PHP applications may face risk if they leave systems unpatched. Talos estimates that about half of PHP systems may not receive a patch. PHP 8.1 and older receive no fixes. PHP 8.2 security support ends on December 31, 2026.

• Upgrade to a fixed, supported PHP release as soon as possible. Talos strongly advises organizations on PHP 8.1 or older to move to PHP 8.2 or later.
• For CVE-2026-109618, PHP advises setting memory_limit=-1 in configuration that applications cannot override. Also set a low post_max_size, keep upload_max_filesize below it, and enforce request limits at the server or proxy. Use container or cgroup limits to help protect availability.
• For CVE-2026-109619, disable session.upload_progress.enabled and restart all workers. On PHP 8.5, set fatal_error_backtraces=0 and restart all workers. Also remove per request settings that trigger diagnostics before initialization, and fix attacker reachable fatal errors and timeouts.
• These measures may reduce exposure to specific attack paths, but they do not replace an upgrade. Cisco customers can use SNORT signatures 67359 and 67360. Talos also provides the rules through its Community Ruleset.

Expand Your Tech Knowledge

Explore the future of technology with our detailed insights on Artificial Intelligence.

Stay inspired by the vast knowledge available on Wikipedia.

ThreatIntel-V1