Critical PHP Memory Vulnerability Triggers Unauthenticated Remote Code Execution
A critical security vulnerability affecting PHP allows unauthenticated attackers to execute arbitrary commands on vulnerable web servers by triggering memory corruption. PHP, a widely utilized server-side scripting language, handles backend application logic, database interactions, and dynamic web page content generation before delivering final output to user browsers. The PHP development team issued a security update to resolve the flaws, which stem from improper memory management during out-of-memory conditions.
The NCSC continues to monitor threats to evaluate any potential operational impact on organizations across the United Kingdom.
Technical Details of CVE-2026-109618 and CVE-2026-109618
The vulnerability package comprises two distinct CVE identifiers detailing specific memory handling failures within the PHP interpreter. CVE-2026-109618 occurs when an out-of-memory condition interrupts PHP while internal request data remains only partially initialized. During the subsequent request cleanup phase, the system incorrectly treats this invalid, half-formed data as valid information, creating a pathway for corruption.
The second flaw, tracked as CVE-2026-109619, involves request-owned internal state surviving even after its backing memory has been freed by the system. When a worker process handles a subsequent request, it may inadvertently interact with this stale state before normal initialization routines can reset the variables. According to technical advisories, exploiting these combined conditions under precise circumstances permits unauthenticated remote code execution on the host web server.
Administrators must apply official security patches
Administrators maintaining web applications built on PHP must apply the official security patches provided in the latest software release. Server operators should review the comprehensive PHP security advisory for detailed configuration guidance and version-specific patch requirements.
What systems are vulnerable to the PHP security issue?
What systems are vulnerable to this PHP security issue?
Any web server running unpatched versions of PHP that process requests susceptible to out-of-memory triggers can be affected. PHP is utilized not only for direct web development but also within a wide range of third-party products and backend applications.
How do attackers exploit the memory corruption flaw?
Attackers trigger an out-of-memory condition that interrupts internal request initialization or leaves freed memory states active. A subsequent request processed by the same worker then utilizes the stale or invalid data, allowing malicious code execution under specific conditions.
Where can administrators find the official patches?
Administrators can access the official patches and technical documentation through the official PHP security advisory channels and repository updates.