Two days between warning and patch: how the PHP project handled CVE-2026-109618
The PHP project pre-announced its October 2026 security release on 20 October and published fixes on 21 October. For two vulnerabilities rated 9.2 under CVSS v4.0, that schedule is the most useful part of the story for anyone who has to plan a response next time.
What shipped
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 carry the fixes for CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution. CERT.RS and CSIRT.CY both relayed the release with affected ranges and guidance for operators.
The defects
CVE-2026-109618 is memory corruption in the out-of-memory path. PHP enforces memory_limit through longjmp(), and that abort can occur while a request's internal structures are still being populated. Cleanup afterwards can treat uninitialised fields as valid and free memory the request never allocated. Form upload parsing is the example given in the advisory.
CVE-2026-109619 is a lifetime defect. Internal request state can remain reachable after the memory behind it has been released, with a fatal error named as one way to reach the condition. A stale reference used later in the same request acts on memory the allocator may already have reissued.
Why the disclosure pattern matters
The pre-announcement gives distributions and long-term support vendors a day to stage packages before the technical detail becomes public. CERT.RS notes that distribution maintainers and LTS providers had the fixes in advance, which is why refreshing packages on Linux is normally faster than waiting for a source build.
The gap is also the reason embedded software lags. Appliances that bundle PHP have no mechanism to ingest an upstream patch on that timetable, and the advisories point to the NCSC-NL repository as the place to check whether a given third-party product is affected.
For defenders, the two-day window is the practical budget for identifying which systems run an affected interpreter. Anything that takes longer than that to compile a version inventory will finish the work after the patch is public.
Exploitation conditions and impact
Neither flaw requires credentials. The first needs a request that crosses the memory ceiling while the interpreter is building request state. The second needs the abnormal termination path and a surviving reference.
Successful exploitation gives code execution as the web server user, exposing application secrets and any internal service the host can reach. Repeated triggering also produces denial of service through worker crashes.
Affected scope
All PHP 8.5 releases below 8.5.12, 8.4 below 8.4.27, 8.3 below 8.3.36 and 8.2 below 8.2.35. PHP 8.1 and older are end-of-life, with the project publishing minimal retrospective fixes for 7.4, 8.0 and 8.1 for source builders and organisations without an LTS provider.
Exposure context
A ZoomEye query for app="PHP" returned 94,382,282 matching assets when this was recorded. Because PHP fingerprints rarely expose a patch level, the count describes the size of the verification problem rather than the size of the vulnerable population.
Remediation
Update to the fixed build for each branch in use and verify that the running service, not only the on-disk binary, reports the new version. Rebuild container base images and check digests of the running containers. Contact appliance vendors directly about their bundled interpreter. For unsupported branches, either take the retrospective fixes or plan a migration.
If the update has to wait, isolate public-facing PHP applications, cap request body size at the proxy, and keep log retention long enough to review unusual requests after the fact.
Top comments (0)