Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution

Two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2, were publicly disclosed on October 21. Exploitation of either flaw permits unauthenticated remote code execution with the privileges of the web server process. The vulnerabilities impact PHP starting from version 5.4 and were discovered through the combined use of AI models Gemini 4 Argon and GPT-5.6 Sol. The resulting security patch exceeds 10,000 lines of code.

The core attack technique relies on forcing a fatal error such as out-of-memory during request processing. Because of the bug, PHP may treat a newly allocated but uninitialized array as fully initialized. An attacker who floods memory with crafted requests can cause the same memory region to be freed and reallocated for different arrays. Pointers and fields inside the corrupted array then contain attacker-controlled data from prior requests. When PHP later cleans up the array after the error, it invokes destructor functions at addresses supplied by the attacker.

Three distinct exploitation vectors have been identified. The first uses deeply nested parameters in x-www-form-urlencoded forms to exceed memory_limit before array initialization completes. The second leverages the PHP_SESSION_UPLOAD_PROGRESS feature during multipart file uploads, creating a use-after-free condition that also permits memory disclosure via the Set-Cookie header. The third vector, present in PHP 8.5, abuses the fatal_error_backtraces setting to trigger a second use-after-free on the subsequent request.

Address Space Layout Randomization requires the attacker to obtain a memory leak before reliable code execution is possible. A complete working exploit chain that achieves arbitrary command execution is currently public only for the PHP_SESSION_UPLOAD_PROGRESS path. Amazon observed exploitation attempts as early as October 17, and Cloudflare later recorded millions of probing requests following disclosure.

Network indicators include the presence of the PHP_SESSION_UPLOAD_PROGRESS parameter in multipart bodies and unusually long PHPSESSID values containing percent-encoded memory contents. Suricata signatures have been published to detect both exploitation attempts and successful memory leaks.

Users should upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. Until patches can be applied, administrators are advised to set session.upload_progress.enabled=0, fatal_error_backtraces=0, and impose strict request-size limits at the web server or reverse-proxy layer. Only the official PHP update fully resolves both vulnerabilities.