Critical Threats Behind PHP: Dissecting Dangerous RCE Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Recently, the web development ecosystem was shaken by the disclosure of two critical vulnerabilities with a CVSS score of 9.2 in the core of PHP. These vulnerabilities allow attackers to perform full Remote Code Execution (RCE) server takeover and run malicious code even without any authentication.

These two vulnerabilities are documented in GitHub Security Advisories CVE-2026-109619 and CVE-2026-109618. Both point to a fundamental weakness in how PHP manages memory when dealing with errors or system interrupts, particularly in environments such as mod_php and PHP-FPM.

Dissecting the Two PHP Security Flaws

#

The main issue behind both vulnerabilities stems from the internal behavior of PHP (especially in persistent worker environments such as PHP-FPM or mod_php) when managing memory allocation and state while processing requests concurrently.

1. RCE via Stale Global State CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp)

#

The first vulnerability exploits freed memory (Use-After-Free / UAF) through stale global state in a PHP worker that was not properly cleaned up.

How does this vulnerability work?

#

In its architecture, a PHP worker stays alive (persistent) to serve multiple HTTP requests in sequence. This worker stores several configuration and global status values such as error information, session state, or extensions pointing to memory owned by the currently running request. Ideally, before the request memory is released, this global state must be reset.

However, when that request is interrupted unexpectedly by a fatal error (such as a failed compilation, out-of-memory conditions, or maximum execution time exceeded), the lifecycle is cut short prematurely. PHP then frees the request memory but forgets to reset its references. As a result, the worker retains a dangling pointer that points to an address that is no longer valid.

When an attacker sends a second request to the same worker, certain components such as the INI configuration file reader or the session upload progress feature may access that corrupted pointer before normal initialization completes. By manipulating the memory layout (heap layout), the attacker can inject and execute their payload.

2. RCE via OOM Corruption CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)

#

The second vulnerability also stems from memory management, but specifically targets PHP’s built-in Out-of-Memory (OOM) handling mechanism.

How does this vulnerability work?

#

Historically, when the memory limit (memory_limit) is exceeded, PHP uses a system-level command called longjmp() to “jump” out of the routine currently running and go directly to the request shutdown procedure.

The weakness occurs if longjmp() is triggered too early, before the request memory has been fully initialized. An attacker exploits this by deliberately draining PHP memory as quickly as possible. They do this by flooding the server with extreme multipart form data, such as sending an unlimited number of headers or stacking an enormous number of input field names.

Once PHP runs out of memory while parsing this form, execution is forced to jump to the shutdown routine. The problem is that this shutdown path tries to read corrupted request data that has been left in a broken state because of the OOM interruption. This corrupted memory condition is what attackers use to gain execution control (RCE).

Affected Versions

#

Both of these critical vulnerabilities affect a broad range of currently supported PHP releases:

Temporary Mitigation (If You Cannot Update Yet)

#

If the server cannot be updated immediately, there are several administrative workarounds that can be used to reduce risk:

• Disable the Request Memory Limit: Set memory_limit=-1 in php.ini. This removes the per-request memory cap, which attackers often exploit to trigger deliberate OOM corruption.

• Disable Session Upload Progress: For PHP-FPM users, ensure the configuration session.upload_progress.enabled=0 is applied so attackers cannot use upload sessions as a memory attack vector.

• WAF (Web Application Firewall): Block multipart requests completely at the frontend layer (such as in Nginx) if your web application does not use file upload features.

Update PHP Immediately!

#

Check your current PHP version with the following command:

php -v