Home
LIVE+00:00:00
2026.10.21
Disclosed · 14:00 UTC
CVE-2026-109618 · CVE-2026-109619 · CVSS 4.0 9.2

Is your PHP site
affected?

Two flaws in PHP itself let an unauthenticated attacker run code on your server. Updating WordPress, Drupal or Laravel does not fix them. Update PHP now.

One normal GET request. We read the PHP version from the Server and X-Powered-By headers and compare it with the fixed releases. Nothing is exploited and nothing is stored.

Scroll for the fix
01 · Severity

Four numbers.

Severity
9.2/10

CVSS 4.0 score for each CVE. Unauthenticated, network-reachable, full impact on confidentiality, integrity and availability.

PHP security advisories
Head start
4days

An exploitation attempt hit Amazon's honeypot network on October 17, four days before the patch shipped.

Amazon Threat Intelligence, via Tenable
Reach
5.4.0

The earliest PHP release that contains the affected code path. That is more than ten years of PHP.

Calif write-up
Workarounds
0complete

Configuration changes reduce the risk but do not remove it. Updating PHP is the only complete fix.

PHP security team
02 · Timeline

This already started.

Attackers moved before the patch shipped. If you run PHP on the internet, start your investigation from October 17, not from the day you patch.

  1. Oct 17 · 2026
    First attempt seen

    Amazon's MadPot honeypots record an exploitation attempt, four days before public disclosure.

    Amazon Threat Intelligence
  2. Oct 20 · 2026
    The IDs leak

    CVE identifiers circulate early. PHP pulls the release forward a day and CERT-EU publishes advisory 2026-018.

    PHP Foundation · CERT-EU
  3. Oct 21 · 14:00 UTC
    Patches ship

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released with two advisories. CISA, the UK NCSC and the Canadian Cyber Centre issue alerts.

    php.net · CISA · NCSC
  4. Oct 21 → now
    Broad exploitation

    Amazon reports attempts from multiple actors. Cloudflare sees early attacks. watchTowr reproduces both bugs and sees attempts against each.

    Amazon · Cloudflare · watchTowr
03 · How it works

Two bugs. One request.

Neither bug needs a login, a plugin, or a weak password. Both live in the PHP runtime, beneath whatever application you run on it.

CVE
2026-109618
Class
OOM corruption

Out of memory, out of control.

  1. A crafted uploadThe attacker sends a multipart request built to exhaust memory while still inside PHP's apparent limits.
  2. PHP bails outOn out-of-memory, PHP uses longjmp() to escape. Some request memory is reachable before it is fully initialised.
  3. Shutdown trusts garbageRequest cleanup reads and branches on that half-built memory as if it were valid.
  4. Code executionConfirmed for unauthenticated RCE under Apache mod_php. FrankenPHP and LSAPI are likely susceptible.
Technical detail

Advisory: GHSA-w8hw-w9fx-j79w

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

The fix: removes longjmp() for OOM. It adds a delayed soft OOM at the next VM safe point and a hard OOM that calls _exit() at a higher threshold.

CVE
2026-109619
Class
Use-after-free

Yesterday's request, still in memory.

  1. Request A breaks somethingA fatal error, a timeout, an early INI diagnostic or session upload progress leaves global state pointing at memory the request owned.
  2. The worker carries onThat memory is freed when request A ends, but the pointer to it is not reset.
  3. Request B reads the stale pointerSome operations run before the next request initialises, and they read the freed memory.
  4. Code executionWith a crafted heap layout the attacker gets memory disclosure and RCE with the web worker's privileges.
Technical detail

Advisory: GHSA-6wmf-4rv5-p3rp

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weaknesses: CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

Condition: the producer and consumer requests must land on the same worker. Error, session, object and extension state can all be left behind.

04 · Versions

Fixed releases.

Both CVEs are fixed in the same four releases. Anything older on a supported branch is affected.

BranchAffectedFixed inStatus
8.5below 8.5.128.5.12Patch
8.4below 8.4.278.4.27Patch
8.3below 8.3.368.3.36Patch
8.2below 8.2.358.2.35Patch
7.4 – 8.1allNo official releaseSource backport only
5.4 – 7.3allNoneNo fix

Running a distribution package such as 8.1.2-1ubuntu2.x or 8.2.x+deb12u1? Linux distributions and LTS vendors got the patches in advance and may backport them without changing the upstream version number. Check your vendor's advisory.

Banner hidden?

Paste your version instead.

Run php -v or php-fpm -v on the server, or copy the PHP version line from phpinfo(). The check runs in your browser and sends nothing.

05 · Who is exposed

If it serves PHP to the web, it counts.

Every PHP installation that serves web requests is at risk. Risk is highest under Apache mod_php, where the demonstrated exploit fires before any application code runs.

Highest risk
Apache mod_php

Exploit triggers on an unauthenticated request before your application code starts.

At risk
PHP-FPM

Behind nginx, Apache or Caddy. Restart the pool, not only the web server.

At risk
LiteSpeed / LSAPI

Common on shared hosting. Named as likely susceptible to the OOM bug.

At risk
FrankenPHP

Long-lived workers make state reuse between requests more likely.

At risk
php-cgi

Still in production on older hosts and control panels.

Apps on affected runtimes
  • WordPress
  • Drupal
  • Joomla
  • Magento
  • Laravel
  • Symfony
  • MediaWiki
  • phpBB
  • WHMCS

Updating the application does not fix a vulnerable PHP runtime. The app is not the bug. PHP is.

06 · Remediation

Fix it today.

  1. Upgrade to a fixed release8.5.12, 8.4.27, 8.3.36 or 8.2.35. On 7.4 to 8.1, apply your vendor's backport or move to a supported branch.
  2. Restart every PHP workerPHP-FPM pools, Apache, LiteSpeed and any other process that loaded the old binary. A package upgrade alone leaves the old code running.
  3. Verify what the live site runsCheck the version your web workers report, not just the CLI. They are often different binaries.
  4. Can't patch yet? Cut exposureRestrict public access until you can. CERT-EU recommends isolating internet-facing apps until the fix is applied and verified.
  5. Hunt from October 17Review web and PHP error logs for crashes, fatal errors and unusual multipart requests since the first observed attempt.
verify
# what the CLI and FPM binaries are
php -v
php-fpm -v            # or php8.3-fpm -v

# what the live site says (if it says anything)
curl -sI https://example.com | grep -i php

# restart workers after upgrading
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2
php.ini · stopgap only
; CVE-2026-109618: enforce so apps cannot override
memory_limit = -1

; CVE-2026-109619: keep off even after patching
; if you do not use the feature
session.upload_progress.enabled = 0

; PHP 8.5 only
fatal_error_backtraces = 0

; php-fpm pool, if performance allows
pm.max_requests = 1

Set these administratively and restart every worker. None of them is a complete mitigation. Cloudflare's WAF rules for known exploit vectors are a stopgap that only covers traffic routed through Cloudflare.

The server you forgot is the one that gets found first.

One URL is easy to check. Every forgotten staging box, old marketing site and acquired subdomain is not. Strobes maps your external attack surface, finds what runs an affected PHP, proves what is actually exploitable, and tests it again after you fix it.

Join Attacker's First Look
  • Every internet-facing PHP host, not just the one you know about
  • Exploitability proven, not inferred from a banner
  • Retested after the patch, so you know it held
Talk to our team

Need help scanning your entire environment?

One URL is easy. Every forgotten PHP host is not. Tell us what you run and we will come back within one business day with a plan, not a brochure.

Loading form…