PHP has released a critical security update addressing vulnerabilities that could allow attackers to execute commands on any web server running the language. This update is significant as PHP is a widely used server-side scripting language essential for web development, powering numerous applications and websites globally.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could lead to an out-of-memory (OOM) condition in PHP, resulting in memory corruption. This corruption, under specific circumstances, could be exploited to achieve unauthenticated remote code execution, posing a severe risk to web applications.
Details of the Vulnerabilities
The first vulnerability, CVE-2026-109618, involves how PHP handles out-of-memory situations, which can interrupt the execution process while internal request data is only partially initialized. This flaw may lead to invalid data being treated as valid during request cleanup, creating an opportunity for exploitation.
The second vulnerability, CVE-2026-109619, relates to the persistence of request-owned internal state after its backing memory has been freed. If a subsequent request is handled by the same worker, it may inadvertently use this stale state before the normal initialization process resets it, potentially leading to further exploitation.
Mitigation and Response
PHP has addressed these vulnerabilities in its latest security update, and users are strongly advised to apply the patch to safeguard their systems. The full details of the security advisory can be found on the official PHP website.
The National Cyber Security Centre (NCSC) has indicated that it will continue to monitor the situation for any potential impact on UK organizations, emphasizing the importance of prompt action in mitigating these risks.
As PHP remains a cornerstone of web development, the implications of these vulnerabilities highlight the ongoing need for vigilance in cybersecurity practices, particularly for organizations relying on PHP for their web applications.
