CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
MentionsApache Software Foundation
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges.
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
