Overview
- The PHP Project published fixes for CVE-2026-109618 and CVE-2026-109619 on Wednesday, October 21, closing two flaws in PHP’s memory management and error-handling paths that together permit remote code execution.
- Security authorities have rated the bugs critical (CVSS 9.2) and warn that the vulnerabilities affect all PHP releases since PHP 5 and common server interfaces such as mod_php, PHP-FPM and LSAPI, plus containers and embedded device web interfaces.
- Hosts, CDNs and vendors are deploying temporary mitigations such as WAF rules and configuration hardening but security teams say those measures reduce risk only temporarily and do not replace applying the official patches.
- Several German municipalities and public institutions have taken websites offline as a precaution and the BSI raised its alert level to Orange, warning that leaked details increase the chance that automated exploits will appear quickly.
- Administrators should update PHP to the patched releases or approved backports, check appliances and Docker images for embedded vulnerable PHP, and expect follow-on consequences such as service outages, data theft risks, and urgent patching work across hosting providers and public services.