Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

PHP before 8.2.35 and related releases allows remote code execution

Original title: VU#763488: Memory corruption vulnerabilities in PHP

CERT/CC Vulnerability Notes ()3 min read2 · 1 read
Read at kb.cert.org
Part of a story covered by 12 sourcesPHP patches PHP2Shell; scans continue without confirmed compromiseMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Two flaws let unauthenticated attackers send crafted HTTP requests; a mod_php proof of concept runs before application code.

CERT/CC says PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 have two critical memory flaws, CVE-2026-109618 and CVE-2026-109619. An unauthenticated remote attacker can use crafted HTTP requests to corrupt memory and potentially run arbitrary code. Apache mod_php is called particularly exposed because proof-of-concept requests triggered the issue before application code ran. Users are told to update immediately; temporary configuration limits are offered but do not fully protect.

Unconfirmed: The note demonstrates proof-of-concept exploitation but does not say the flaws are used in real attacks.

Key facts
  • CVE-2026-109618 is an out-of-memory cleanup corruption flaw.
  • CVE-2026-109619 is a use-after-free in global state management.
  • Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
  • Limited source backports exist for PHP 7.4, 8.0, and 8.1.
  • OpenAI, Wiz, and Ryan at Calif.io reported the flaws.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote arbitrary code execution over HTTP

ProductAffectedFixed in
PHPprior to 8.2.35, 8.3.36, 8.4.27, and 8.5.128.2.35, 8.3.36, 8.4.27, 8.5.12
What to do
  1. 1.Update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or obtain distribution or LTS fixes.
  2. 2.If patching must wait, apply the listed memory, upload, and session mitigations for both CVEs.
  3. 3.For unsupported PHP 8.1 and older, use LTS backports or move to a supported release.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618CVE-2026-109619
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phpremote-code-executionmemory-corruptionuse-after-freemod-php
Vendors
PHP
Organizations
CERT/CCOpenAIWiz

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109619
+1 related CVE
CVE-2026-109618
Use-after-free RCE in PHP via stale request globals
9.2100%PoC ×13

From the original article

3 min read at kb.cert.org

Overview Two critical memory-related vulnerabilities have been identified in PHP versions prior to 8. 2. 35, 8.

CERT/CC Vulnerability Notes

kb.cert.org

Read the full article at CERT/CC Vulnerability Notes

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.