Imechapishwa: Oct 22, 2026 09:17
Advisory No: TZCERT-SA-26-0141
Source: PHP
Software Affected: PHP versions prior to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed)
PHP is vulnerable to two critical vulnerabilities. Exploitation of these vulnerabilities may allow an unauthenticated remote attacker to execute arbitrary code on the affected system.
PHP is affected by two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS v4.0 scores of 9.2 each. CVE-2026-109618 exists due to improper handling of out-of-memory (OOM) errors, where request memory is left in an invalid state when a memory allocation fails before the memory is fully initialized. CVE-2026-109619 is a use-after-free flaw caused by global state (such as error, session, object and extension state) that is retained by a worker after the memory owned by a previous request has been freed. The vulnerabilities allow a remote attacker to send specially crafted HTTP requests to execute arbitrary code with the privileges of the web server’s PHP worker process. Public proof-of-concept code has been reported for CVE-2026-109618.
Successful exploitation of these vulnerabilities may allow the attackers to take control of affected system and gain access to application source code, configuration files and stored credentials such as database passwords and API keys.
PHP has released security updates (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) to address these vulnerabilities. Users and administrators are encouraged to apply necessary updates. Systems running unsupported PHP versions (8.1 and earlier) should be upgraded to a supported release or patched using vendor-provided backports.
A digest of Tanzania Computer Emergency Response Team coverage of cyber-security news across the globe.
