What are the critical PHP vulnerabilities discovered in 2026 and how can you protect your sites?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• Two critical RCE bugs (CVE - 2026 - 109618, CVE - 2026 - 109619) affect the PHP request lifecycle and can be exploited before any application code runs.
• Patch to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (or back - ports for 7.4, 8.0, 8.1) immediately.
• If you cannot upgrade, disable session.upload_progress.enabled and tighten memory_limit/post_max_size as temporary mitigations.
• All PHP deployment models (FPM, mod_php, CGI, FrankenPHP, LiteSpeed, etc.) are vulnerable.

What are the PHP CVE - 2026 - 109618 and CVE - 2026 - 109619 vulnerabilities?

Both CVE - 2026 - 109618 and CVE - 2026 - 109619 are remote - code - execution bugs that trigger before any user - supplied PHP runs. CVE - 109618 corrupts out - of - memory handling, while CVE - 109619 re - uses stale global state after a free, allowing an attacker to execute code across requests.

Which PHP releases are impacted?

All currently supported PHP branches are affected. The official patched releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35 Older branches (7.4, 8.0, 8.1) receive back - ported fixes only. No other versions are vulnerable to these specific CVEs.

How do the vulnerabilities work in practice?

• CVE - 2026 - 109618: An attacker forces a worker to hit memory_limit, causing out - of - memory handling to leave request data partially initialized. The interpreter then treats the corrupted memory as valid, leading to unauthenticated RCE.
• CVE - 2026 - 109619: Request - owned internal data is not fully cleared after a request finishes. When the same worker processes a new request, the stale pointer can be reused, enabling cross - request RCE. The exploit requires session.upload_progress.enabled to be on.

Which deployment models are at risk?

Any environment that runs PHP to serve web requests is exposed, including:

• PHP - FPM pools behind Nginx or Apache
• Apache mod_php
• php - cgi and CGI - FastCGI setups
• FrankenPHP, LiteSpeed, and other PHP - compatible runtimes The vulnerability is in the core interpreter, not in specific extensions, so all of these are vulnerable.

What can I do if I cannot upgrade immediately?

Apply the following configuration mitigations while you plan the upgrade:

1. Disable the upload - progress feature - set session.upload_progress.enabled=0 in php.ini. This blocks the exploit path for CVE - 2026 - 109619.
2. Avoid the out - of - memory path - set memory_limit=-1 or raise the limit high enough that normal requests never trigger OOM. This reduces the chance of CVE - 2026 - 109618.
3. Restrict request size - lower post_max_size to the smallest value that still satisfies your application needs. Smaller payloads make it harder to trigger the OOM condition.
4. Restart all PHP workers - after changing the configuration, reload or restart the PHP process manager (e.g., systemctl restart php-fpm). This clears any stale global state that may already be present.

How should I prioritize patching?

1. Patch production servers first - apply the official releases listed above to any live site.
2. Patch staging and development environments next - ensure the same version is used throughout your pipeline to avoid configuration drift.
3. Verify the patch - after upgrade, run php -v and confirm the version number matches a patched release.
4. Monitor for exploit attempts - enable web - application - firewall rules that block unusually large POST bodies and log any session.upload_progress activity.

How can I confirm my site is no longer vulnerable?

• Run php -r "echo phpversion();" on each server and compare against the patched versions.
• Check that session.upload_progress.enabled is set to 0 in phpinfo() output if you cannot upgrade.
• Use a tool that sends crafted oversized requests and verifies the server returns a clean error instead of executing code. Decloak’s free scan can quickly confirm the HTTP/TLS posture and static HTML, but it does not actively test for these PHP - specific RCE bugs; you need a dedicated PHP runtime test or the official patches.

Why is immediate action essential?

Both CVEs have a CVSS v4.0 score of 9.2, indicating critical severity. Because the flaws are exploitable before any application code runs, an attacker does not need to know the internal logic of your app. Successful exploitation gives full control over the server process, allowing data theft, ransomware deployment, or further lateral movement.

What should I do after patching?

• Update your dependency lock files to reference the new PHP version.
• Re - run your CI/CD pipeline to ensure all tests pass with the upgraded interpreter.
• Document the change in your change - management system, noting the CVE IDs and the mitigation steps taken.
• Schedule regular PHP version reviews - PHP releases a new minor version roughly every six months; staying current reduces exposure to future critical bugs.