Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Executive Summary

Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance.

PHP is widely used across web servers and content management systems globally. We recommend assessing your exposure to these vulnerabilities and patching immediately.

Unit 42 has seen proof of concept of these vulnerabilities. At least one European government has taken their website offline as a precaution.

• CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, allowing attackers to reliably achieve RCE using out-of-memory (OOM) triggers.
• CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be read or branched on during subsequent requests, enabling attackers to execute arbitrary code.

At the time of publication, Palo Alto Networks Cortex Xpanse has identified the presence of over 22.6 million exposed instances potentially vulnerable to CVE-2026-109618 and CVE-2026-109619 based on our telemetry.

Palo Alto Networks customers receive protections from and mitigations for CVE-2026-109618 and CVE-2026-109619 in the following ways:

• Cortex XDR and XSIAM
• Cortex Xpanse
• Advanced Threat Prevention Plus with Frontier Virtual Patching

Palo Alto Networks also recommends assessing your exposure to these vulnerabilities and patching immediately.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Palo Alto Networks Product Protections for CVE-2026-109618 and CVE-2026-109619

Palo Alto Networks customers can leverage several product protections and updates to identify and defend against these vulnerabilities.

Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Cortex XDR, Cloud Runtime and XSIAM

Cortex XDR, Cloud Runtime and XSIAM help protect against post-exploitation activities using the multi-layer protection approach.

Cortex Cloud Posture and Prisma Cloud Compute

Cortex Cloud Posture and Prisma Cloud Compute helps detect the vulnerable PHP versions in both code and cloud.

Cortex Xpanse

Cortex Xpanse can identify exposed devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the PHP Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module.

Next-Generation Firewall

Next-Generation Firewall with the following security subscriptions can help block the attacks:

• Advanced Threat Prevention Plus with Frontier Virtual Patching since October 20, 2026 via the following Threat Prevention signature 543004.

Additional Resources

• Security advisory: Critical remote code execution vulnerabilities, update now - PHP