CISA Adds Two Critical PHP Flaws to Actively Exploited Vulnerabilities
CISA has recorded active exploitation of PHP flaws CVE-2026-109618 and CVE-2026-109619. Fixes have been available since October 21 across several supported branches.
On October 26, the U.S. agency CISA added PHP flaws to KEV—CVE-2026-109618 and CVE-2026-109619—to its Known Exploited Vulnerabilities catalog. The addition means the agency has recorded their exploitation in the wild. Fixed PHP versions have been available since October 21, and administrators of internet-facing servers should prioritize the update.
Under certain conditions, both vulnerabilities can lead to remote code execution. A successful attack could execute code with the privileges of the web worker process, provide access to data available to that process, or disrupt service availability.
PHP flaws in KEV: which versions to deploy
The PHP project released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. According to the project, updating to a fixed release is the only complete mitigation. Temporary configuration measures therefore do not guarantee that the risk will be eliminated.
After deploying the packages, the relevant PHP workers or services must also be restarted so the server actually uses the fixed runtime. Administrators should first inventory PHP installations, especially those that accept web requests from the internet.
Two flaws with different conditions
CVE-2026-109618 is a flaw in handling an out-of-memory situation. The PHP project confirmed functional remote code execution over HTTP when using Apache mod_php, with no authentication required for the attack.
The second flaw, CVE-2026-109619, is related to an outdated internal state that may persist between requests. PHP confirmed remote code execution for Apache mod_php and PHP-FPM configurations, but only under specific conditions.
Practical exploitability is not automatically the same in every deployment. It depends on the SAPI interface, configuration, extensions, and application behavior. This circumstance does not change the fact that CISA has recorded real exploitation for both CVEs.
What CISA has not disclosed so far
Neither CISA nor the available materials identify the threat group, victims, scope of the attacks, or exploitation technique used. It is also not confirmed which specific Linux distributions, hosting services, or organizations in Slovakia are affected.
Administrators should monitor the availability of fixed packages from distributions, vendor advisories for products with their own PHP runtime, and any technical indicators of compromise. Application logs, reverse-proxy logs, and PHP-FPM records may also be relevant if details about recorded attacks emerge.
- Verify the PHP version used on publicly accessible servers.
- Update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, depending on the branch in use.
- Restart PHP workers and related services after deploying the fix.
- Monitor vendor security advisories and available indicators of compromise.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2026-109618 to KEV and recorded exploitation.
- CISA Known Exploited Vulnerabilities Catalog – Confirms the addition of CVE-2026-109619 to KEV and recorded exploitation.
- PHP php-src security advisory GHSA-w8hw-w9fx-j79w – Describes CVE-2026-109618, the fixed versions, confirmed RCE for mod_php, and the fact that updating is the only complete mitigation.
- PHP php-src security advisory GHSA-6wmf-4rv5-p3rp – Describes CVE-2026-109619, the exploitation conditions, and confirmed RCE for both mod_php and PHP-FPM.
- UK National Cyber Security Centre – Independently confirms the critical nature of the two flaws, the release of fixes, and the recommendation to update immediately.
Verified and updated: October 27, 2026 06:19
