PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2 and capable of enabling unauthenticated remote code execution in web-serving deployments. The flaws occur during the PHP request lifecycle before application code executes: one involves corrupted state after an out-of-memory condition, while the other involves stale request state reused by long-lived workers. PHP-FPM, Apache mod_php, CGI, FrankenPHP, LiteSpeed, and similar environments are affected, with mod_php described as especially exposed, while unsupported PHP 8.1 and earlier require vendor backports, source backports, or upgrades. The recommended response is immediate patching and verification of the PHP runtime actually deployed on hosts and container images, since Composer manifests and conventional dependency scans do not reliably identify interpreter versions. Temporary configuration changes may reduce exposure in limited circumstances but are not considered complete mitigations. Snyk explains that its Unmanaged, Container, API, and Web scanning capabilities can help locate affected installations or test exposed applications, whereas its Open Source scans generally cannot detect PHP runtime vulnerabilities from Composer dependency files alone.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.