PHP Patches Two Critical RCE Vulnerabilities

The PHP Foundation has released emergency security updates across all supported PHP branches, patching two critical remote code execution vulnerabilities that can be triggered without authentication on default server configurations.

CVE-2026-109618 exploits a race condition in PHP's memory limit handling. When a request hits the memory_limit at precisely the wrong moment, PHP can leave partially initialized internal data in place and later treat it as valid, corrupting memory. Full RCE was demonstrated on Apache with mod_php using default settings, and confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 involves stale internal state after a fatal error, leaving pointers to memory owned by a previous request. A subsequent worker request can then access freed memory — a classic use-after-free — also confirmed as exploitable for RCE on real-world Apache/mod_php applications.

Both flaws sit in PHP's memory management and error handling layers, code paths that nearly every request touches. The PHP Foundation acknowledged in the post that the fix for CVE-2026-109618 was partially identified as far back as 2024, following PHP's first external security audit in years (conducted by Quarkslab via OSTIF, funded by the Sovereign Tech Agency). Competing fix approaches each carried trade-offs — compatibility breaks, denial-of-service risks, or requiring coordination across third-party extensions — and the security team stalled repeatedly.

"The delay was a structural failure, caused by both the security team's decision process and its lack of resources," the Foundation stated plainly. Process changes are underway.