PHP Patches Runtime RCE Flaws CVE-2026-109618 and CVE-2026-109619 After Premature Leak
Two critical PHP runtime RCE flaws received emergency patches after early disclosure. The vulnerabilities affect nearly every PHP version and allow code execution or memory disclosure before application code executes, with highest risk on mod_php. Only full runtime updates close the issues; workarounds are incomplete.
The flaws, internally tracked as PHP2Shell, reside in the PHP engine rather than user applications. A single request can trigger code execution on Apache mod_php before any site code runs. PHP-FPM offers partial containment through worker termination on early failure, yet one variant still reaches execution. Researchers demonstrated live memory reads that extract tokens and keys from concurrent requests without needing RCE first. The advisory lists FrankenPHP, LiteSpeed, php-cgi and PHP-FPM as affected alongside mod_php.
Details surfaced on 20 October, one day before the scheduled 14:00 UTC release. Wiz, Calif and OpenAI researchers supplied the reports. Linux distributions received advance patches, requiring changelog inspection rather than version-string checks. PHP 8.1 and earlier receive no further updates; 8.2 reaches end-of-life 31 December 2026. Source backports exist for 7.4, 8.0 and 8.1 but demand manual compilation.
Workarounds such as memory_limit=-1, low post_max_size and session.upload_progress.enabled=0 reduce specific paths yet leave other variants open. No configuration fully substitutes for the runtime update. The pattern of foundational language flaws bypassing application hardening repeats across prior engine issues and underscores inventory gaps in container and host fleets.
Immediate action requires runtime replacement followed by restarts of Apache, PHP-FPM and long-running workers. Exploit attempts are already observed; continued monitoring of request patterns and memory usage anomalies will determine whether unpatched hosts become widespread targets within the next 72 hours.
Wiz: At least 40 percent of externally reachable PHP servers will still show vulnerable banners by 28 October 2026.
Sources (3)
- [1]PHP Security Advisory(https://www.php.net/security)
- [2]The Hacker News(https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html)
- [3]Wiz Research Disclosure(https://wiz.io/blog/php-runtime-vulnerabilities)