CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. CVE CVSSv4 Description CVE-2026-109618 9.2 (Critical) RCE via OOM corruption CVE-2026-109619 9.2 (Critical) RCE via stale global state All installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The vendor considers mod_php the
- Vendor
- PHP
- Product
- PHP
- CVSS v4.0
- 9.2
- EPSS
- 1.00 (p100)
- Exploitation
- observed in the wild
- Exposure class
- Web platform
Why it ranks 79 (Critical)
- Exploitation observed in the wild
- CVSS v4.0 9.2 critical
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 34 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-115560 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.