Two critical remote code execution vulnerabilities disclosed on October 21, 2026 affect every PHP installation serving web requests. CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, allow unauthenticated attackers to execute arbitrary code. The PHP security team considers the risk highest for modphp, where a demonstrated exploit triggers the attack before any application code runs. This is not a theoretical concern — exploitation is practical and immediate. The first vulnerability (CVE-2026-109618) exploits out-of-memory handling: when PHP hits a memory limit, it can interrupt execution while internal request data is only partially initialized. The subsequent cleanup routine treats that invalid, half-built data as valid, creating a corruption path an attacker can control. The second (CVE-2026-109619) involves stale global state: request-owned internal data can survive after its backing memory has been freed, and a later request handled by the same worker can use that dangling pointer before normal initialization resets it. Both are use-after-free class bugs at the interpreter level — they bypass application-layer defenses entirely. Patches are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team also provided minimal source backports for the unsupported PHP 7.4, 8.0, and 8.1 branches — an unusual step that signals the severity. Linux distributions received patches in advance. The volunteer-maintained rpms.remirepo.net repository will not have updates immediately, and the PHP team explicitly urges users of that repo to switch to distribution packages or build from source. The mitigations offered for those who cannot patch immediately are partial and come with blunt caveats. For the OOM bug: set memorylimit=-1 to remove the controllable failure path, lower postmaxsize, and enforce limits at the proxy level. For the stale-state bug: disable session.uploadprogress, disable fatalerrorbacktraces on PHP 8.5, and fix any attacker-reachable fatal errors. The advisory is explicit that none of these make an installation safe — they merely narrow specific attack paths. The timing is notable. PHP 8.2 reaches end of life on December 31, 2026, and will receive no further security fixes after that date. PHP 8.6.0 is in release candidate testing (RC3 as of October 8). The security team gave a 24-hour advance notice on October 20 and reserved the right to release early if exploitation evidence appeared. This coordinated disclosure — advance notice to vendors, minimal backports for unsupported branches, public advisory with detailed mitigation — is the PHP project operating at its most disciplined. The structural concern is PHP's installed base. PHP powers roughly 75% of websites with a known server-side language, including WordPress, which alone accounts for over 40% of all websites. Many of these installations are managed by non-specialists, run on shared hosting, or depend on third-party repository maintainers who may not ship patches the same day. The gap between patch availability and actual deployment across the long tail of PHP installations is where the real risk lives. This is a generative security event: the PHP project identified, patched, and coordinated disclosure of interpreter-level vulnerabilities with unusual transparency and speed. The extraction risk is not from the PHP team but from the attack surface window — every hour between disclosure and patching is an opportunity for exploitation at scale.
