Affected Systems

All PHP installations serving web requests: PHP 8.5 below 8.5.12, PHP 8.4 below 8.4.27, PHP 8.3 below 8.3.36, PHP 8.2 below 8.2.35, and all versions back to PHP 5.4. Highest risk on Apache mod_php; also affects PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.

Exploitation Status

Early exploit attempts observed in the wild by Cloudflare as of October 21, 2026. Working exploit demonstrated for mod_php. No confirmed successful breaches reported yet. Not yet in CISA KEV catalog at time of article.

Business Impact

Unauthenticated remote code execution on any PHP web server, regardless of application code quality. Flaws exist in PHP runtime itself, meaning even a simple "Hello World" page is exploitable. Attackers can also read worker process memory containing passwords, tokens, API keys, and certificates from other requests without achieving code execution. Apache mod_php deployments face highest risk with single-request exploit before application code runs. PHP-FPM partially mitigated by worker shutdown behavior but still vulnerable. Configuration workarounds are incomplete; only patching provides full protection.

Urgency

🔴 Immediate

Recommended Actions

  • Update PHP runtime immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on branch in use, then restart Apache, PHP-FPM, and all long-running PHP workers
  • For Linux distributions, verify patch application by checking package changelog for CVE-2026-109618 and CVE-2026-109619, not version string alone
  • If immediate patching is impossible, set session.upload_progress.enabled=0 and memory_limit=-1, keep post_max_size low, and enforce request-size limits at web server or proxy as partial risk reduction only
  • Review memory_limit and post_max_size settings after patching to ensure they meet application requirements, as the fix adds a hard memory limit that terminates processes
  • Monitor for indicators of prior compromise: unusual multipart requests followed by memory-limit errors or HTTP 500 responses, oversized PHPSESSID cookies, and unexplained PHP worker restarts