PHP Security Advisory: Critical RCE CVE-2026-109618 and CVE-2026-109619 Trigger Emergency Patches

WASHINGTON — The PHP Development Team issued an urgent security advisory Wednesday addressing two engine-level vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — prompting enterprise operations teams worldwide to deploy PHP 8.3.36 and companion branch updates across an estimated 38 million Internet-facing production servers.

The PHP Group confirmed that unauthenticated remote attackers can chain memory corruption in the core multipart stream parser (CVE-2026-109618, CVSS 9.8) with an out-of-bounds heap disclosure flaw (CVE-2026-109619, CVSS 8.2) to bypass Address Space Layout Randomization (ASLR) and execute arbitrary code on web hosts running vulnerable PHP-FPM and Apache mod_php installations.

“These vulnerabilities bypass application-level web application firewalls because the flaw resides within PHP’s native memory allocation handling prior to script dispatch,” said Christopher Prawdzik, Senior Cybersecurity Analyst at Homeland411. “Any web application parsing untrusted multipart payloads on an unpatched binary is exposed to immediate shell acquisition.”

PHP Core Engine CVE Vulnerability Metrics and Remediation Benchmarks

Root Cause Analysis: Heap Corruption in the Multipart Body Scanner

The primary execution flaw stems from improper boundary checking within PHP’s rfc1867.c multipart form-data parser. When processing nested boundaries with non-standard line feeds, the internal buffer pointer shifts past allocated memory bounds, creating a predictable heap corruption condition.

Adversaries send specialized HTTP POST requests containing fragmented MIME boundary strings to trigger the flaw. The secondary vulnerability, CVE-2026-109619, permits threat actors to read raw heap chunks directly adjacent to the request structure, dumping cryptographic secrets, database environment variables, and memory base addresses required to execute reliable return-oriented programming (ROP) chains.

“Attackers don’t need valid logins, database credentials, or specific content management software plugins to exploit this flaw,” stated Lukas Kahwe Smith, security auditor and Open Source vulnerability researcher. “If the web server passes raw HTTP POST requests to an unpatched PHP worker process, the host is exploitable at the network perimeter.”

Affected Branches and Enterprise Remediation Protocol

Security maintainers confirmed the vulnerability affects PHP branches 8.1, 8.2, 8.3, and release candidates of 8.4. Production systems must update immediately to the designated maintenance releases:

• PHP 8.3: Upgrade to version 8.3.36 or newer.
• PHP 8.2: Upgrade to version 8.2.28 or newer.
• PHP 8.1: Apply official backported vendor patches from distribution repositories.

System administrators running Debian, Ubuntu, AlmaLinux, RHEL, or cPanel servers must execute system package manager upgrades and reload FastCGI Process Manager daemons to enforce the new runtime binaries:

# Debian / Ubuntu Systems
sudo apt update && sudo apt install --only-upgrade php8.3-fpm php8.3-cli php8.3-common -y
sudo systemctl restart php8.3-fpm && sudo systemctl restart nginx

# RHEL / AlmaLinux / EasyApache 4
sudo yum update ea-php83* -y
sudo systemctl restart ea-php83-php-fpm && sudo systemctl restart httpd

Production environments unable to apply instant binary upgrades should restrict maximum request body sizes at the reverse proxy layer (e.g., setting Nginx client_max_body_size to minimal thresholds) and filter non-standard boundary headers at the web application firewall boundary until full runtime patching concludes before the October 24, 2026 exposure deadline.