Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619
Blog post from Fastly
CVE-2026-109618 and CVE-2026-109619 are critical Core PHP vulnerabilities disclosed on October 21, 2026, each rated 9.2 under CVSS v4.0, that can enable remote code execution in PHP versions 5 through 8. The flaws arise from PHP’s use of longjmp() when handling out-of-memory conditions and fatal errors, which can leave request or global memory in invalid or uninitialized states that later requests may access. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while some distribution and long-term-support vendors may offer backported patches; minimal source backports are also available for PHP 7.4, 8.0, and 8.1. Users are advised to upgrade or consult their vendor promptly, and Fastly customers can optionally enable a Next-Gen WAF rule intended to detect exploitation patterns and provide temporary mitigation while patches are deployed.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.