PHP memory flaws may allow remote code execution
4 companies named across 2 categories, the first article referencing Data.
Companies mentioned
Best suited for
- Seniority
- Staff
- Job function
- Cybersecurity / Information Security
- Persona
- Security Operations Practitioner
- Buyer role
- Technical Implementer / Administrator
- Decision stage
- Post Buy
- Adoption curve
- Early Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Cybersecurity / Exposure, Risk & Governance / Vulnerability Management & Attack Surface Management
Our classification, not the publisher's statement. Best suited for, not only for.
Two memory-related vulnerabilities affect PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit them through specially crafted HTTP requests, potentially achieving arbitrary code execution.
CVE-2026-109618 is a memory corruption flaw in out-of-memory handling, triggered when an out-of-memory condition interrupts request processing while internal request data is only partly initialized, so later cleanup routines may touch invalid memory. CVE-2026-109619 is a use-after-free in global state management, where a worker retains a reference to request-owned state after its memory is freed and a later request on that worker can read it before initialization resets it.
Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely through specially crafted HTTP requests, compromising confidentiality, integrity, and availability of the web service and underlying infrastructure. Apache mod_php deployments are at particularly high risk, since proof-of-concept exploitation has shown unauthenticated requests can trigger the attack before any application code executes.
Patched releases 8.2.35, 8.3.36, 8.4.27, and 8.5.12 remediate these vulnerabilities, with source downloads at php.net/downloads, and all users are strongly encouraged to update immediately. Linux users should check with their distribution vendor, as many distributions received patches in advance. PHP 8.1 and older no longer receive official updates; contact an LTS vendor for backports or upgrade to a supported version. Limited source backports for PHP 7.4, 8.0, and 8.1 are available from the PHP security team.
If immediate patching is not feasible, these temporary measures may reduce exposure to specific attack paths but do not provide complete protection. For CVE-2026-109618, set memory_limit=-1 at an administrative level, set post_max_size to 8M or 32M if uploads are needed, keep upload_max_filesize below it, and enforce request limits at the web server or proxy. Container or cgroup limits can serve as an availability boundary, but RLIMIT_AS and RLIMIT_DATA should not bound memory because they make mmap() fail and trigger the vulnerable path.
For CVE-2026-109619, set session.upload_progress.enabled=0 and restart all workers, set fatal_error_backtraces=0 on PHP 8.5, and remove per-request settings that emit diagnostics before initialization. Remediate attacker-reachable fatal errors and timeouts. System owners can limit impact through network segmentation and minimum necessary privileges, and users are advised to monitor for unusual PHP process behavior or unexpected memory allocation patterns.
Blog post, originally published by Molly Jaconski at kb.cert.org.