Published on October 21, 2026 at 5:51 PM

CVE-2026-109618 and CVE-2026-109619 represent critical security vulnerabilities within the PHP runtime environment. These vulnerabilities are particularly concerning due to their potential to allow remote code execution (RCE) without authentication, posing significant risks to affected systems.

What the vulnerability is

Both CVE-2026-109618 and CVE-2026-109619 are unauthenticated RCE vulnerabilities. CVE-2026-109618 is caused by out-of-memory (OOM) corruption, while CVE-2026-109619 arises from a stale global state in the session.upload_progress feature. These vulnerabilities can be exploited to execute arbitrary code on the server, potentially leading to full system compromise.

Technical details

At the time of writing, specific technical details such as CVSS scores, CWE identifiers, and attack vectors have not been published. However, the vulnerabilities are classified as critical, with a CVSS v4.0 score of 9.2, indicating their severe impact.

Impact

The primary impact of these vulnerabilities is the potential for unauthenticated attackers to execute arbitrary code on affected servers. This could lead to data breaches, system manipulation, or further exploitation of the compromised environment.

Affected systems

Affected systems have not been publicly disclosed at the time of writing. However, it is noted that PHP versions 5.x, 6.x, and 7.x are end-of-life and remain vulnerable. Detection involves checking the PHP version from HTTP response headers or common PHP info pages and comparing it against fixed releases such as 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

Mitigation

Currently, there is no specific patch information available. Organisations are advised to ensure their PHP installations are updated to the latest supported versions to mitigate potential risks. Regularly monitoring for updates and applying patches as they become available is crucial.

In conclusion, continuous scanning and monitoring of systems for vulnerabilities like CVE-2026-109618 and CVE-2026-109619 are essential to preemptively identify and mitigate risks before they can be exploited by attackers.