← Back to Blog
Security advisory•3 min read

PHP: Critical RCE Flaws Added to CISA KEV (CVE-2026-109618)

S
SmartSITT Engineering Team

On 21 October 2026 the PHP project published an advisory for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. On 26 October 2026 CISA added both to its Known Exploited Vulnerabilities (KEV) catalogue. The PHP project strongly encourages all PHP users to update immediately.

Who is affected

The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php.

ProductAffected versionsFixed in
PHP 8.5Earlier than 8.5.128.5.12
PHP 8.4Earlier than 8.4.278.4.27
PHP 8.3Earlier than 8.3.368.3.36
PHP 8.2Earlier than 8.2.358.2.35
PHP 8.1 and olderNo longer supported by the PHP projectUpgrade, or ask your distribution or LTS vendor for a backported fix
  • CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partly initialised, and request cleanup may then treat that data as valid. NVD lists CVSS 3.1 9.8 (Critical).
  • CVE-2026-109619: request-owned internal state can survive after its memory is freed, and a later request handled by the same worker may use it. NVD lists CVSS 3.1 8.1 (High); PHP, as CNA, rates it 9.2 (Critical) under CVSS 4.0, as it does CVE-2026-109618.

Is it being exploited?

CISA added both CVEs to the KEV catalogue on 26 October 2026 with a due date of 29 October 2026, and lists known ransomware campaign use as "Unknown". The PHP advisory describes a demonstrated exploit against mod_php in which an unauthenticated request triggers the attack before any application code runs. Neither source names a threat actor.

What to do now

  1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from php.net, or install your Linux distribution's or LTS vendor's updated package; vendors received the patches in advance.
  2. On PHP 8.1 or older, ask your vendor about a backported fix or move to a supported version. The PHP project also provided minimal source backports for PHP 7.4, 8.0 and 8.1.
  3. If you cannot update yet, the PHP project says only an update is a complete solution; these measures reduce exposure to specific paths but do not make an installation safe:
    • CVE-2026-109618: set memory_limit=-1 where applications cannot override it (for example php_admin_value in the FPM pool or Apache configuration), and set a low post_max_size (8M without uploads, 32M with them) with upload_max_filesize below it. Consider request-size, field, multipart, header and nesting limits at the web server or proxy. Do not use RLIMIT_AS or RLIMIT_DATA.
    • CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini, the FPM pool or the server configuration (not ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0.

On 23 October 2026 the PHP project also advised keeping session.upload_progress.enabled=0 until the next bugfix release, as a precaution against a further, unlikely RCE vector (CVE-2026-115560).

How to check whether you were affected

The sources we reviewed do not publish indicators of compromise. The PHP project points to the GitHub security advisories for technical details, and CISA's entry refers to its Forensics Triage Requirements. At minimum, confirm the PHP version on every web server, container image and application that bundles PHP.

How SmartSITT can help

SmartSITT offers cybersecurity services and a gap assessment to review your exposure. We provide 24/7 monitoring and support; that is a fact about our service, not a statement about this vulnerability.

Sources

Ready to upgrade your infrastructure?

Contact our experts to discuss how these strategies apply to your specific environment.

Schedule a Consultation