PHP has released security updates for two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they may allow remote code execution without prior authentication.
Both vulnerabilities affect the PHP runtime itself, which means the risk is not limited to a specific CMS or framework. WordPress, Laravel, Symfony, and other PHP applications may run on an affected PHP version even if the application itself is fully up to date.
The two vulnerabilities at a glance
Remote Code Execution via Out-of-Memory corruption
In specific out-of-memory situations, PHP may leave internal structures in an invalid or partially initialized state.
Critical · CVSS 9.2Remote Code Execution via stale global state
Part of PHP's global state may remain associated with memory from a previous HTTP request and later be accessed by another request handled by the same worker.
Critical · CVSS 9.2Which PHP versions are affected?
Security fixes have been released for the currently supported PHP branches. Systems running older versions should be updated.
| PHP version | Affected versions | Patched version |
|---|---|---|
| PHP 8.2 | below 8.2.35 | 8.2.35+ |
| PHP 8.3 | below 8.3.36 | 8.3.36+ |
| PHP 8.4 | below 8.4.27 | 8.4.27+ |
| PHP 8.5 | below 8.5.12 | 8.5.12+ |
Minimum recommended versions
What is CVE-2026-109618?
CVE-2026-109618 is related to the way PHP handles Out-of-Memory (OOM) conditions.
Under certain circumstances, PHP may interrupt the current operation before parts of its internal data structures have been fully initialized. Shutdown handling may later process this inconsistent state, potentially causing memory corruption.
If successfully exploited, an attacker may potentially execute arbitrary code with the privileges of the PHP worker process.
Why is this vulnerability serious?
In certain deployment configurations, the attack can be carried out remotely over HTTP without prior access to an administrative interface or an authenticated user account.
What is CVE-2026-109619?
The second vulnerability is related to the management of global state between individual HTTP requests.
PHP worker processes typically handle multiple requests over their lifetime. After a request finishes, internal state should be properly cleared and reinitialized.
On certain error paths, part of this state may remain associated with memory that has already been released. A subsequent request handled by the same worker may access this stale information.
This type of behavior may result in a use-after-free condition and may potentially lead to memory corruption and code execution.
Which environments should be checked?
If PHP handles publicly accessible HTTP requests, the runtime version should be verified regardless of how the application is deployed.
- Apache with mod_php
- PHP-FPM
- php-cgi
- FrankenPHP
- LiteSpeed / LSAPI
- Docker containers running PHP
- WordPress hosting environments
- Laravel and Symfony applications
What should system administrators do?
With runtime vulnerabilities of this type, checks should not be limited to the version returned by the CLI.
All production environments, worker processes, and container images should be reviewed.
- Check the actual PHP version used by the web server.
- Upgrade to the patched security release for the corresponding branch.
- Restart PHP-FPM, Apache, or the relevant runtime after the update.
- Review all PHP-FPM pools.
- Check Docker images and their PHP base images.
- Update both production and staging environments.
- Review applications still running unsupported PHP versions.
- Monitor web server and application logs for unusual activity.
What does this mean for WordPress websites?
CVE-2026-109618 and CVE-2026-109619 are not WordPress vulnerabilities. They are issues in the PHP runtime.
However, this means that a fully updated WordPress website may still be running on a vulnerable PHP version.
For this reason, maintaining a WordPress website should involve not only updating WordPress core, themes, and plugins, but also maintaining the underlying server environment.
PHP 8.1 and older versions
If your website is still running a PHP version outside the official support lifecycle, the situation requires additional attention.
Some Linux distributions may provide backported security patches, but availability depends on the specific operating system and vendor.
Is there a workaround without updating?
With critical runtime vulnerabilities, temporary configuration changes may reduce exposure to some exploitation paths, but they should not be treated as equivalent to applying the official patch.
The reliable approach is to upgrade PHP to a version that includes the security fixes.
Security does not end with application code
A production website is built on an entire technology stack. A vulnerability in any layer may put the whole application at risk.
- Operating system
- Web server
- PHP runtime
- Framework or CMS
- Composer dependencies
- Database server
- Docker images
- Reverse proxy
- SSL/TLS configuration
Security patching is part of infrastructure maintenance.
With critical RCE vulnerabilities, the time between publication of the advisory and actual deployment of the security update is an important part of risk management.
Official sources
- CVE-2026-109618 – PHP Security Advisory
- CVE-2026-109619 – PHP Security Advisory
- PHP – Official Website
Frequently asked questions
How serious are CVE-2026-109618 and CVE-2026-109619?
Both vulnerabilities are rated Critical and may, under certain conditions, allow remote code execution.
Is WordPress vulnerable?
The issue is in the PHP runtime, not in WordPress itself. However, a WordPress website running on an affected PHP version uses the same vulnerable runtime and therefore requires a server-level update.
Is restarting PHP-FPM enough?
No. Restarting the service does not replace the security update. The patched PHP version should be installed first, followed by a restart of the worker processes.
Which PHP version should we upgrade to?
The minimum versions containing the published security fixes are PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, and PHP 8.5.12.
Not sure whether your infrastructure is affected?
DXA Soft can review your PHP environment, deployment configuration, and installed versions, and assist with updating your servers and applications.
Contact us