PHP’s October RCE fixes: patch the runtime, then verify the workers

CVE-2026-109618, GHSA-w8hw-w9fx-j79w, concerns memory corruption following an out-of-memory early exit. PHP may leave request memory in an invalid state that shutdown later consumes. The PHP advisory reports complete unauthenticated RCE over HTTP against Apache mod_php using default input and memory limits; build details and frontend behavior affect exploit reliability.

For this first vulnerability, the advisory says FPM exits a child if request startup fails, which prevents that exact startup path. It still identifies application-dependent susceptibility after successful startup, while stating that a complete FPM exploit for this particular vulnerability had not been demonstrated in the advisory.

CVE-2026-109619, GHSA-6wmf-4rv5-p3rp, concerns stale global state referring to memory from a previous request. Exploitation requires a producer of stale state and a later consumer in the same worker. Its advisory describes confirmed mod_php exploitation and a validated, application-dependent FPM path involving session upload progress. FPM must not therefore be described as categorically unaffected.

Both vendor advisories classify the issues as critical. This review does not supply an invented numerical CVSS score or infer observed attacks from the existence of a proof of concept.

Both advisories list these fixed upstream versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Select the fixed release within the deployed supported branch, or a later supported security release. For older unsupported branches, use a supported migration or an explicitly supported vendor security fix; do not assume a fix exists.

Linux distributions and managed hosts may backport patches while retaining an older upstream version string. Verify their advisory, complete package revision and patch coverage for both CVEs. Conversely, finding a fixed CLI binary does not prove that Apache, FPM, a separate pool or another container uses it.

The advisories were published October 21; the retrieved PHP 8.4 NEWS file labels 8.4.27 October 22. These are distinct source timestamps, not a reason to invent a single universal release time.

An internet-facing, affected mod_php service warrants urgent remediation because the vendor documents unauthenticated RCE. A confirmed affected FPM deployment also needs accelerated treatment, with priority increased for reachable application conditions, privileged worker credentials and sensitive data. Exact business impact depends on worker permissions, connectivity and stored secrets.

The FIRST EPSS response retrieved for October 22 reports 0.05307 for CVE-2026-109618 and 0.05757 for CVE-2026-109619: approximately 5.31% and 5.76% modeled probability of exploitation activity in the next 30 days. These estimates are not evidence of exploitation, a probability that a particular company will be breached, or a substitute for the vendor’s severity assessment.

Neither CVE appeared in the retrieved CISA KEV snapshot, catalog version 2026.10.21. That observation is bounded by that catalog version. It neither establishes absence of active exploitation nor justifies delaying a patch. This review did not independently verify real-world attack telemetry.

Application and platform owners should identify internet-facing PHP services, web-server integration, loaded extensions, frontend configuration, worker pools, images and managed-hosting responsibilities. Prioritize confirmed affected services rather than assuming every application on a server uses the same runtime.

Deploy the complete vendor fix for both CVEs, rebuild images where necessary and restart or replace every relevant PHP worker through the supported service-management procedure. Verify the package revision or image digest inside the serving workload and the runtime used by web requests. Use internal diagnostics rather than exposing a public phpinfo page.

Run application regression checks covering authentication, uploads, sessions, background workers and integrations. Verify that traffic no longer reaches old instances. Dependencies include tested backups, rollout capacity and the hosting provider’s release availability. Residual risk includes an overlooked pool, an unrebuilt image or an unpatched third-party service.

If patching cannot happen immediately, use the vendor’s current advisory and a time-bounded exception. A WAF or rate limit may reduce reachable attack traffic but is not proof of complete mitigation. The first advisory discusses configuration workarounds with significant memory-availability tradeoffs; the second warns that there is no complete generic configuration mitigation. Do not apply an isolated memory setting as a blanket fix.

Security operations should preserve relevant web, proxy, runtime and container telemetry. Investigate unusual worker crashes, unexpected child processes, modified application files, credential access and outbound connections, using established local baselines. None of these observations is a unique indicator for these CVEs, and their absence does not prove an uncompromised system.

Where compromise is suspected, follow incident-response procedures for containment, forensic collection, clean recovery and scoped secret rotation. Installing a fixed package does not remove an attacker’s persistence or invalidate credentials already stolen.

This analysis did not execute an exploit, scan an organization, or verify a specific hosted PHP deployment. Analytical confidence is high in the vendor’s described mechanisms and version boundaries; company exposure and actual compromise remain unassessed.