{"id":1213,"date":"2026-11-03T09:00:00","date_gmt":"2026-11-02T22:00:00","guid":{"rendered":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/"},"modified":"2026-11-03T20:56:07","modified_gmt":"2026-11-03T09:56:07","slug":"cve-2026-109618-cve-2026-109619-php","status":"publish","type":"post","link":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/","title":{"rendered":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained"},"content":{"rendered":"\n<p class=\"has-pale-cyan-blue-background-color has-background wp-block-paragraph\">CVE-2026-109618 and CVE-2026-109619 are two critical PHP flaws that can let an attacker run code on a web server without logging in. Both are being exploited, and the fix is a PHP update, not a plugin or theme update.<\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Security advisory<\/strong> \u00b7 Written in plain English, with the technical detail and the fix. Checked against the vendor and national CERT advisories at the time of writing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Other recent advisories<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/cve-2026-111497\/\" target=\"_blank\" rel=\"noreferrer noopener\">What Is CVE-2026-111497 (Node2Shell)? Brotli Risk and Fix<\/a><\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:16px\">All advisories: <a href=\"https:\/\/catharsis.net.au\/blog\/category\/cve-exploits\/\" target=\"_blank\" rel=\"noreferrer noopener\">CVE &amp; Exploits<\/a><\/p>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">TL;DR<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>CVE-2026-109618 and CVE-2026-109619 (nicknamed &quot;php2shell&quot;) are two critical flaws in PHP itself that can let an attacker run their own code on a web server without a password. Yes, you should act: both are on the US CISA list of vulnerabilities known to be exploited.<\/li>\n\n\n<li>PHP fixed them on 21 October 2026 (UTC) in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release.<\/li>\n\n\n<li>Updating WordPress, plugins or themes does not fix this. The PHP software underneath has to be updated, by you or by your host.<\/li>\n\n\n<li>If your server uses a Linux distribution&#8217;s PHP packages, the patched version number may look &quot;old&quot;. Check the distribution&#8217;s advisory, not just <code>php -v<\/code>.<\/li>\n\n\n<li>PHP&#8217;s interim settings reduce some attack paths but, in PHP&#8217;s own words, do not make an installation safe.<\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">In this post<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"#in-plain-english\">In plain English<\/a><\/li>\n\n\n<li><a href=\"#who-is-affected\">Who is affected?<\/a><\/li>\n\n\n<li><a href=\"#technical-analysis\">Technical analysis<\/a><\/li>\n\n\n<li><a href=\"#is-it-being-exploited\">Is it being exploited?<\/a><\/li>\n\n\n<li><a href=\"#how-to-fix-it\">How to fix it<\/a><\/li>\n\n\n<li><a href=\"#what-this-means-for-wordpress-sites\">What this means for WordPress sites<\/a><\/li>\n\n\n<li><a href=\"#key-takeaways\">Key takeaways<\/a><\/li>\n\n\n<li><a href=\"#sources\">Sources<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"in-plain-english\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP is the programming language that runs a large share of the web, including every WordPress site. When someone visits a PHP site, the web server hands the request to PHP, PHP builds the page and sends it back. On a busy server the same PHP worker process handles many visitors&#8217; requests one after another.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These two flaws are in how PHP cleans up after a request goes wrong:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>CVE-2026-109618<\/strong> happens when PHP runs out of the memory it is allowed for a request. PHP abandons the request in a hurry, and some of its internal bookkeeping is left half-built. When PHP then tidies up, it reads that broken data.<\/li>\n\n\n<li><strong>CVE-2026-109619<\/strong> happens when internal settings that should be wiped at the end of a request still point to memory that has already been freed. The next request on the same worker can trip over that stale pointer.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Both are memory-safety bugs. With careful, repeated attempts, an attacker can turn them into running their own commands on the server, with the same permissions as the web server. From there they could read your database, change your site or use the server to attack others.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Who is at risk? Anyone running PHP that serves web pages: company websites, WordPress and WooCommerce stores, customer portals, intranets, and appliances or software with PHP built in. The attacker doesn&#8217;t need an account or any help from a user. They do need to send specially shaped web requests, often many of them.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"who-is-affected\">Who is affected?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noreferrer noopener\">PHP security advisory<\/a> and the two GitHub advisories (<a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noreferrer noopener\">GHSA-w8hw-w9fx-j79w<\/a> and <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noreferrer noopener\">GHSA-6wmf-4rv5-p3rp<\/a>) list the same affected and fixed versions for both CVEs:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>PHP branch<\/th>\n<th>Vulnerable versions<\/th>\n<th>Fixed version<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>8.5<\/td>\n<td>8.5.0 to 8.5.11<\/td>\n<td>8.5.12<\/td>\n<\/tr>\n<tr>\n<td>8.4<\/td>\n<td>8.4.0 to 8.4.26<\/td>\n<td>8.4.27<\/td>\n<\/tr>\n<tr>\n<td>8.3<\/td>\n<td>8.3.0 to 8.3.35<\/td>\n<td>8.3.36<\/td>\n<\/tr>\n<tr>\n<td>8.2<\/td>\n<td>8.2.0 to 8.2.34<\/td>\n<td>8.2.35<\/td>\n<\/tr>\n<tr>\n<td>8.1 and older<\/td>\n<td>Treat as vulnerable<\/td>\n<td>No official release (see below)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Which server set-ups?<\/strong> PHP says all installations serving web requests are at risk, including Apache with the built-in PHP module (mod_php), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The risk is not equal:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Apache with mod_php<\/strong> is rated highest risk. PHP confirmed full remote code execution against it over HTTP with default memory and input limits.<\/li>\n\n\n<li><strong>PHP-FPM<\/strong> (common behind nginx and on most modern hosts) is susceptible according to PHP&#8217;s source analysis, but for CVE-2026-109618 no complete exploit had been demonstrated against it when the advisory was published. The CVE-2026-109619 session upload progress path was validated against both mod_php and PHP-FPM.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>End-of-life branches.<\/strong> PHP 8.1 and older no longer get releases from the PHP project. Because of the severity, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves. Otherwise, your options are a distribution or long-term-support vendor that backports the fix, or upgrading to a supported branch. PHP 8.2 itself reaches end of life on 31 December 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Hosting and managed WordPress.<\/strong> If you&#8217;re on shared hosting or a managed WordPress plan, your host controls PHP. Many will have patched already, but you should confirm rather than assume. Ask them directly which PHP build you&#8217;re running and whether it includes the fixes for both CVEs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Distribution backports change the version string.<\/strong> Linux distributions often patch their own PHP packages without moving to the new upstream version. For example, <a href=\"https:\/\/ubuntu.com\/security\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Ubuntu<\/a> lists the fix for 24.04 LTS as package <code>8.3.6-0ubuntu0.24.04.13<\/code>, and for 22.04 LTS as <code>8.1.2-1ubuntu2.28<\/code>. Running <code>php -v<\/code> on those servers shows 8.3.6 or 8.1.2, which looks vulnerable but isn&#8217;t once the package is updated. <a href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Debian<\/a> shipped <code>8.2.35-1~deb12u1<\/code> for bookworm and <code>8.4.27-1~deb13u1<\/code> for trixie. Red Hat&#8217;s <a href=\"https:\/\/access.redhat.com\/security\/vulnerabilities\/RHSB-2026-013\" target=\"_blank\" rel=\"noreferrer noopener\">bulletin RHSB-2026-013<\/a> covers RHEL 7 to 10 (on RHEL 7 only CVE-2026-109619 applies) and says fixes are being expedited. Alpine tracks the <a href=\"https:\/\/security.alpinelinux.org\/vuln\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">php82 to php85 packages<\/a>. The package version, not the PHP version, is what counts.<\/p>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Not sure how exposed your network is?<\/strong> Ask for a free security health check. We look at your setup and tell you, in plain English, what to fix first. Complimentary, at our discretion.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=cve-advisories&amp;utm_content=cve-2026-109618-cve-2026-109619-php-health-check\" target=\"_blank\" rel=\"noreferrer noopener\">Book a free health check<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"technical-analysis\">Technical analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Both flaws sit in the PHP core request lifecycle, not in an optional extension. The PHP changelog entry for the fix reads &quot;Avoid state corruption via bailout&quot; (<a href=\"https:\/\/www.php.net\/ChangeLog-8.php\" target=\"_blank\" rel=\"noreferrer noopener\">PHP 8 ChangeLog<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2026-109618: out-of-memory corruption.<\/strong> PHP uses <code>longjmp()<\/code> to bail out of the current context when a request hits its memory limit. According to the <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noreferrer noopener\">advisory<\/a> and the <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">NVD record<\/a>, some code paths make request memory reachable before it is fully initialised. If an allocation fails at that moment, request shutdown later reads or branches on invalid memory. The advisory describes several ways an attacker can force the out-of-memory condition from outside, mostly through how multipart form bodies and uploads are parsed. On mod_php this can happen during automatic body parsing, before any application code runs, which is why it is application-independent there. PHP-FPM exits the child process when startup fails, which narrows exposure to out-of-memory conditions after normal startup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CVE-2026-109619: stale global state.<\/strong> PHP keeps some global state (error, session, object and extension state) that temporarily points into per-request memory. In some cases it isn&#8217;t reset, or is filled again after being reset. A later request on the same worker can then read it before it&#8217;s reinitialised, which is a heap use-after-free (<a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noreferrer noopener\">advisory<\/a>, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-109619\" target=\"_blank\" rel=\"noreferrer noopener\">NVD<\/a>). Exploitation needs a &quot;producer&quot; request that leaves the state behind and a &quot;consumer&quot; operation on the same worker. Fatal errors, including out-of-memory errors and execution timeouts, can be producers. Paths PHP names include session upload progress (on by default, and it doesn&#8217;t require the application to call <code>session_start()<\/code>), fatal error backtraces on PHP 8.5, and early INI diagnostics from <code>.htaccess<\/code> or server-level <code>php_value<\/code> settings. Hiding errors with <code>error_reporting<\/code>, <code>display_errors<\/code> or <code>@<\/code> does not prevent it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Scores, and why they differ.<\/strong> PHP, as the CVE numbering authority, scored both at CVSS v4.0 <strong>9.2 (Critical)<\/strong>:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>CVSS:4.0\/AV:N\/AC:H\/AT:P\/PR:N\/UI:N\/VC:H\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N<\/code><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Metric<\/th>\n<th>Value<\/th>\n<th>Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>AV:N<\/td>\n<td>Network<\/td>\n<td>Reachable over the internet<\/td>\n<\/tr>\n<tr>\n<td>AC:H<\/td>\n<td>High complexity<\/td>\n<td>Needs heap layout and timing to line up, often many attempts<\/td>\n<\/tr>\n<tr>\n<td>AT:P<\/td>\n<td>Attack requirements present<\/td>\n<td>Depends on SAPI, configuration and build<\/td>\n<\/tr>\n<tr>\n<td>PR:N \/ UI:N<\/td>\n<td>None \/ None<\/td>\n<td>No login, no user action<\/td>\n<\/tr>\n<tr>\n<td>VC\/VI\/VA:H<\/td>\n<td>High<\/td>\n<td>Full compromise of the vulnerable system<\/td>\n<\/tr>\n<tr>\n<td>SC\/SI\/SA:N<\/td>\n<td>None<\/td>\n<td>No direct impact scored on other systems<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">NVD&#8217;s own CVSS v3.1 scores differ: <strong>9.8<\/strong> for CVE-2026-109618 (it rated attack complexity Low) and <strong>8.1<\/strong> for CVE-2026-109619 (attack complexity High). Red Hat scores CVE-2026-109618 at 8.1 and rates the issue Important, noting that RHEL 8 and later default to PHP-FPM, where exploitation is &quot;difficult in practice&quot;. The disagreement is about how hard exploitation is, not whether the impact is serious.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A third, related issue.<\/strong> On 23 October 2026 PHP published an informational advisory for CVE-2026-115560, another session upload progress path that needs an uncommon combination of configuration and application behaviour (changing <code>session.serialize_handler<\/code> at runtime). The October releases don&#8217;t fix it; PHP said the full advisory would come with the next release and suggested <code>session.upload_progress.enabled=0<\/code> in the meantime.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"is-it-being-exploited\">Is it being exploited?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. As of 3 November 2026:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>CISA KEV:<\/strong> CISA added both CVEs to its <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Known Exploited Vulnerabilities catalog<\/a> on 26 October 2026, with a 29 October due date for US federal agencies. Known ransomware use is listed as &quot;Unknown&quot;. CISA&#8217;s <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/21\/critical-vulnerabilities-php-require-immediate-patching\" target=\"_blank\" rel=\"noreferrer noopener\">alert<\/a> (21 October, revised 26 October) urges immediate patching.<\/li>\n\n\n<li><strong>National CERTs:<\/strong> The Canadian Centre for Cyber Security&#8217;s <a href=\"https:\/\/cyber.gc.ca\/en\/alerts-advisories\/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619\" target=\"_blank\" rel=\"noreferrer noopener\">AL26-026<\/a> noted open-source reporting of exploitation in its 26 October update. The Netherlands NCSC keeps a <a href=\"https:\/\/github.com\/NCSC-NL\/php2shell\/wiki\" target=\"_blank\" rel=\"noreferrer noopener\">product status tracker<\/a> for software that bundles PHP. In Australia, the ASD&#8217;s ACSC published a <a href=\"https:\/\/www.cyber.gov.au\/alert\/critical-vulnerabilities-in-php\" target=\"_blank\" rel=\"noreferrer noopener\">Critical alert<\/a> ahead of the release.<\/li>\n\n\n<li><strong>Observed traffic:<\/strong> TU Delft&#8217;s <a href=\"https:\/\/php2shell.delftintellab.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">php2shell observatory<\/a> recorded 84,209 exploitation requests from 795 IP addresses in 74 countries between 21 October and 3 November 2026, and saw requests resembling the attack before the fixed releases were published.<\/li>\n\n\n<li><strong>Proof of concept:<\/strong> Several proof-of-concept repositories and scanners are circulating. Most have not been independently confirmed.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">What is not publicly known: how many sites have actually been compromised, and whether specific criminal groups are behind the traffic.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-fix-it\">How to fix it<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>\n<p><strong>Find your PHP version safely.<\/strong> On the server, run <code>php -v<\/code> (and <code>php-fpm -v<\/code> or your FPM binary, which can differ from the command-line PHP). On a Debian or Ubuntu server, check the package with <code>dpkg -l | grep php<\/code>; on RHEL-family systems use <code>rpm -qa | grep php<\/code>. On shared hosting, look in your hosting control panel&#8217;s PHP settings or ask the host. If you must use a <code>phpinfo()<\/code> page, create it with a random file name, read it, and delete it straight away. Never leave it public.\n<strong>Check:<\/strong> you know the PHP branch and, for distribution packages, the exact package version for every site, including staging and old sites.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>Upgrade to a fixed release or the patched package.<\/strong> Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or install your distribution&#8217;s security update (for example, Debian DSA-6574-1 or DLA-4848-1, Ubuntu USN-8948-1). Don&#8217;t forget containers and appliances: rebuild images from updated base images, and check vendors for products that bundle PHP.\n<strong>Check:<\/strong> the version or package matches the fixed version in the PHP or distribution advisory.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>Restart PHP, not just reload.<\/strong> Restart PHP-FPM and the web server (Apache, if you use mod_php) so every worker loads the new code. Long-running workers keep running the old binary until they are restarted.\n<strong>Check:<\/strong> worker processes have a start time after the update.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>Confirm from the outside.<\/strong> Load the site and check the PHP version reported by the web-serving SAPI (not just the command line). Then remove any temporary <code>phpinfo()<\/code> file.\n<strong>Check:<\/strong> the site works, and the reported version or package is the patched one.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>If you can&#8217;t update today, apply PHP&#8217;s interim settings.<\/strong> PHP lists these, applied in <code>php.ini<\/code>, the FPM pool or server configuration (for example <code>php_admin_value<\/code>) so applications can&#8217;t override them, followed by a restart of every worker:<\/p>\n<ul>\n<li>For CVE-2026-109618: <code>memory_limit = -1<\/code>; <code>post_max_size = 8M<\/code> (or <code>32M<\/code> if uploads are needed), with <code>upload_max_filesize<\/code> below <code>post_max_size<\/code>. Don&#8217;t use <code>RLIMIT_AS<\/code> or <code>RLIMIT_DATA<\/code> instead, as these can cause the very allocation failure involved.<\/li>\n<li>For CVE-2026-109619: <code>session.upload_progress.enabled = 0<\/code> (not via <code>ini_set()<\/code> or a <code>.user.ini<\/code> file), and on PHP 8.5 <code>fatal_error_backtraces = 0<\/code>.<\/li>\n<\/ul>\n<p>Removing the memory limit lets one request use much more memory, so set a container or service memory boundary and watch for resource exhaustion. PHP is clear that these measures &quot;do not make an installation safe&quot;.\n<strong>Check:<\/strong> a fresh <code>phpinfo()<\/code> (then deleted) or <code>php -i<\/code> for the same SAPI shows the new values, and the site still works.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>Deal with end-of-life PHP.<\/strong> On 8.1 or older, use a supported vendor&#8217;s backported package or upgrade to a supported branch. CISA advises taking unpatchable or unsupported systems offline. Plan the move off 8.2 before 31 December 2026, too.\n<strong>Check:<\/strong> no internet-facing system runs an unpatched, unsupported PHP.<\/p>\n<\/li>\n\n\n<li>\n<p><strong>Look for signs of compromise.<\/strong> Because exploitation began around the release date, patching alone doesn&#8217;t prove you weren&#8217;t hit. Review web and PHP logs from mid-October onwards, and look for PHP workers launching shells, unexpected files in the web root, new admin accounts or odd outbound connections.\n<strong>Check:<\/strong> anything unexplained is investigated, not just deleted.<\/p>\n<\/li>\n\n<\/ol>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Does your segmentation actually hold?<\/strong> An internal penetration test checks whether someone on one VLAN can reach what they shouldn&#8217;t, and an external network test shows what an attacker can see from the internet.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/pentesting-services\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=cve-advisories&amp;utm_content=cve-2026-109618-cve-2026-109619-php-pentest\" target=\"_blank\" rel=\"noreferrer noopener\">See penetration testing<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-this-means-for-wordpress-sites\">What this means for WordPress sites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>The fix is a PHP fix.<\/strong> WordPress core, plugins and themes run on PHP, so they don&#8217;t carry these bugs and updating them won&#8217;t remove them. On managed WordPress, ask your host to confirm the PHP version or package and the date it was applied.<\/li>\n\n\n<li><strong>Plugins can make it easier.<\/strong> Plugins that accept uploads or large forms, or that trigger memory-heavy or slow operations, give attackers more ways to cause the memory and timeout errors these flaws depend on. Keep them updated and remove ones you don&#8217;t use.<\/li>\n\n\n<li><strong>Test the upgrade on staging.<\/strong> If you&#8217;re moving from 8.1 or 8.2 to a newer branch, test on a staging copy first, because older plugins may not support newer PHP. A patch release within your current branch (for example 8.3.x to 8.3.36) is much lower risk.<\/li>\n\n\n<li><strong>Check the upload progress setting.<\/strong> WordPress doesn&#8217;t rely on PHP&#8217;s native session upload progress. Disabling it is a sensible hardening step even after patching, as the Netherlands NCSC recommends, but test any plugin that shows upload progress bars.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state) are critical PHP core flaws allowing unauthenticated code execution, rated CVSS v4.0 9.2 by PHP.<\/li>\n\n\n<li>Both are listed as exploited by CISA since 26 October 2026, so treat this as urgent rather than routine.<\/li>\n\n\n<li>The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution&#8217;s patched package, followed by a full restart of PHP workers.<\/li>\n\n\n<li>Distribution version strings can look old even when patched. Check the package against the distribution&#8217;s advisory.<\/li>\n\n\n<li>Interim settings only narrow the attack paths. Unsupported PHP 8.1 and older needs a vendor backport, an upgrade or to come off the internet.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>PHP security advisory and release announcements, 20 to 23 October 2026: <a href=\"https:\/\/www.php.net\/\" target=\"_blank\" rel=\"noreferrer noopener\">php.net<\/a><\/li>\n\n\n<li>PHP 8 ChangeLog: <a href=\"https:\/\/www.php.net\/ChangeLog-8.php\" target=\"_blank\" rel=\"noreferrer noopener\">php.net\/ChangeLog-8.php<\/a><\/li>\n\n\n<li>PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-w8hw-w9fx-j79w\" target=\"_blank\" rel=\"noreferrer noopener\">github.com\/php\/php-src<\/a><\/li>\n\n\n<li>PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): <a href=\"https:\/\/github.com\/php\/php-src\/security\/advisories\/GHSA-6wmf-4rv5-p3rp\" target=\"_blank\" rel=\"noreferrer noopener\">github.com\/php\/php-src<\/a><\/li>\n\n\n<li>NVD: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2026-109618<\/a> and <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-109619\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2026-109619<\/a><\/li>\n\n\n<li>CISA alert, 21 October 2026: <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/21\/critical-vulnerabilities-php-require-immediate-patching\" target=\"_blank\" rel=\"noreferrer noopener\">cisa.gov<\/a><\/li>\n\n\n<li>CISA Known Exploited Vulnerabilities catalog: <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">cisa.gov<\/a><\/li>\n\n\n<li>ASD&#8217;s ACSC alert: <a href=\"https:\/\/www.cyber.gov.au\/alert\/critical-vulnerabilities-in-php\" target=\"_blank\" rel=\"noreferrer noopener\">cyber.gov.au<\/a><\/li>\n\n\n<li>Canadian Centre for Cyber Security AL26-026: <a href=\"https:\/\/cyber.gc.ca\/en\/alerts-advisories\/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619\" target=\"_blank\" rel=\"noreferrer noopener\">cyber.gc.ca<\/a><\/li>\n\n\n<li>Netherlands NCSC php2shell tracker: <a href=\"https:\/\/github.com\/NCSC-NL\/php2shell\/wiki\" target=\"_blank\" rel=\"noreferrer noopener\">github.com\/NCSC-NL<\/a><\/li>\n\n\n<li>TU Delft php2shell observatory: <a href=\"https:\/\/php2shell.delftintellab.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">php2shell.delftintellab.com<\/a><\/li>\n\n\n<li>Distribution trackers: <a href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Debian<\/a>, <a href=\"https:\/\/ubuntu.com\/security\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Ubuntu<\/a>, <a href=\"https:\/\/access.redhat.com\/security\/vulnerabilities\/RHSB-2026-013\" target=\"_blank\" rel=\"noreferrer noopener\">Red Hat RHSB-2026-013<\/a>, <a href=\"https:\/\/security.alpinelinux.org\/vuln\/CVE-2026-109618\" target=\"_blank\" rel=\"noreferrer noopener\">Alpine<\/a><\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-light-green-cyan-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:40px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">Not sure whether you are exposed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Catharsis Cyber Security is a Sydney cyber security company. We help organisations find what they run, patch what matters first, and check that the fix holds.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=cve-advisories&amp;utm_content=cve-2026-109618-cve-2026-109619-php-contact\" target=\"_blank\" rel=\"noreferrer noopener\">Book a free health check<\/a><\/div>\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/vulnerability-management\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=cve-advisories&amp;utm_content=cve-2026-109618-cve-2026-109619-php-end-vuln\" target=\"_blank\" rel=\"noreferrer noopener\">Vulnerability management<\/a><\/div>\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--2\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/pentesting-services\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=cve-advisories&amp;utm_content=cve-2026-109618-cve-2026-109619-php-end-pentest\" target=\"_blank\" rel=\"noreferrer noopener\">Penetration testing<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>CVE-2026-109618 and CVE-2026-109619 are two critical PHP flaws that can let an attacker run code on a web server without logging in. Both are being exploited, and the fix is a PHP update, not a plugin or theme update.<\/p>\n","protected":false},"author":2,"featured_media":1212,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[148,149,152,150,151],"class_list":["post-1213","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cve-exploits","tag-cve-2026-109618","tag-cve-2026-109619","tag-patching","tag-php","tag-vulnerability"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog<\/title>\n<meta name=\"description\" content=\"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/\" \/>\n<meta property=\"og:site_name\" content=\"Catharsis | Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T22:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-03T09:56:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Sajal Jain\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sajal Jain\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/\"},\"author\":{\"name\":\"Sajal Jain\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/f0826efb92a7aaf8d46b24715990e099\"},\"headline\":\"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained\",\"datePublished\":\"2026-11-02T22:00:00+00:00\",\"dateModified\":\"2026-11-03T09:56:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/\"},\"wordCount\":2515,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-109618-cve-2026-109619-php.jpg\",\"keywords\":[\"CVE-2026-109618\",\"CVE-2026-109619\",\"patching\",\"PHP\",\"vulnerability\"],\"articleSection\":[\"CVE &amp; Exploits\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/\",\"name\":\"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-109618-cve-2026-109619-php.jpg\",\"datePublished\":\"2026-11-02T22:00:00+00:00\",\"dateModified\":\"2026-11-03T09:56:07+00:00\",\"description\":\"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#primaryimage\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-109618-cve-2026-109619-php.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-109618-cve-2026-109619-php.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Security advisory card: CVE-2026-109618 and CVE-2026-109619 in PHP\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/cve-2026-109618-cve-2026-109619-php\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"name\":\"Catharsis | Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\",\"name\":\"Catharsis | Blog\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"width\":215,\"height\":60,\"caption\":\"Catharsis | Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/f0826efb92a7aaf8d46b24715990e099\",\"name\":\"Sajal Jain\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/Sajal-copy-96x96.jpg\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/Sajal-copy-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/Sajal-copy-96x96.jpg\",\"caption\":\"Sajal Jain\"},\"description\":\"Cyber Security Enthusiast | OSCP | CEH | CHFI | CNSS | Master of IT Security &amp; Master of IT Management\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/author\\\/sajal-jain\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog","description":"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/","og_locale":"en_US","og_type":"article","og_title":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog","og_description":"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.","og_url":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/","og_site_name":"Catharsis | Blog","article_published_time":"2026-11-02T22:00:00+00:00","article_modified_time":"2026-11-03T09:56:07+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg","type":"image\/jpeg"}],"author":"Sajal Jain","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sajal Jain","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#article","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/"},"author":{"name":"Sajal Jain","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/f0826efb92a7aaf8d46b24715990e099"},"headline":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained","datePublished":"2026-11-02T22:00:00+00:00","dateModified":"2026-11-03T09:56:07+00:00","mainEntityOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/"},"wordCount":2515,"commentCount":0,"publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg","keywords":["CVE-2026-109618","CVE-2026-109619","patching","PHP","vulnerability"],"articleSection":["CVE &amp; Exploits"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/","url":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/","name":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained - Catharsis | Blog","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#primaryimage"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg","datePublished":"2026-11-02T22:00:00+00:00","dateModified":"2026-11-03T09:56:07+00:00","description":"CVE-2026-109618 and CVE-2026-109619 let attackers run code on PHP web servers without logging in. Who is affected, exploitation status and how to patch.","breadcrumb":{"@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#primaryimage","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/cve-2026-109618-cve-2026-109619-php.jpg","width":1280,"height":720,"caption":"Security advisory card: CVE-2026-109618 and CVE-2026-109619 in PHP"},{"@type":"BreadcrumbList","@id":"https:\/\/catharsis.net.au\/blog\/cve-2026-109618-cve-2026-109619-php\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/catharsis.net.au\/blog\/"},{"@type":"ListItem","position":2,"name":"What Are CVE-2026-109618 and CVE-2026-109619? PHP Flaws Explained"}]},{"@type":"WebSite","@id":"https:\/\/catharsis.net.au\/blog\/#website","url":"https:\/\/catharsis.net.au\/blog\/","name":"Catharsis | Blog","description":"","publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/catharsis.net.au\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/catharsis.net.au\/blog\/#organization","name":"Catharsis | Blog","url":"https:\/\/catharsis.net.au\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","width":215,"height":60,"caption":"Catharsis | Blog"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/f0826efb92a7aaf8d46b24715990e099","name":"Sajal Jain","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/Sajal-copy-96x96.jpg","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/Sajal-copy-96x96.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/Sajal-copy-96x96.jpg","caption":"Sajal Jain"},"description":"Cyber Security Enthusiast | OSCP | CEH | CHFI | CNSS | Master of IT Security &amp; Master of IT Management","url":"https:\/\/catharsis.net.au\/blog\/author\/sajal-jain\/"}]}},"_links":{"self":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/comments?post=1213"}],"version-history":[{"count":2,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1213\/revisions"}],"predecessor-version":[{"id":1230,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1213\/revisions\/1230"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media\/1212"}],"wp:attachment":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media?parent=1213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/categories?post=1213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/tags?post=1213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}