Published: October 22, 2026
Category: Cybersecurity Alert / Web Infrastructure
If you noticed an unusual number of websites, online portals, and municipal services going offline or entering maintenance mode over the last 24 to 48 hours, a pair of newly disclosed critical vulnerabilities in core PHP is to blame.
On October 21, 2026, the PHP Core Development Team issued urgent security updates addressing two severity rating 9.2 (CVSS v4.0) zero-day flaws. Because exploitation requires no authentication and can execute arbitrary code before application logic even runs, sysadmins and hosting providers around the globe have taken internet-facing servers offline as emergency patching gets underway.
What Happened?
Details regarding the flaws began circulating on social media early in the week, prompting the PHP security team to accelerate their release schedule. The two vulnerabilities impact core PHP memory management and request lifecycle handling:
-
CVE-2026-109618 (Out-Of-Memory Cleanup RCE)
-
Mechanism: PHP enforces configured memory limits (memory_limit) using longjmp() to abort requests exceeding allocation limits.
-
The Flaw: When an Out-Of-Memory (OOM) error triggers while request data (such as multipart form/file uploads) is only partially initialized, the cleanup process incorrectly treats uninitialized memory as valid and attempts to free it. Attackers can control prior memory allocations to execute arbitrary code.
-
-
CVE-2026-109619 (Stale Global State / Use-After-Free RCE)
-
Mechanism: Handles fatal error recovery in persistent worker processes (like PHP-FPM, Apache mod_php, LiteSpeed, or FrankenPHP).
-
The Flaw: Internal request-owned memory state survives after its backing memory is freed following a fatal error. Subsequent requests handled by the same worker process read stale pointers, granting unauthenticated attackers remote code execution (RCE).
-
Why Are So Many Websites Going Down?
PHP powers over 75% of the web—including popular Content Management Systems (CMS) like WordPress, Drupal, and Joomla, as well as thousands of enterprise APIs.
The widespread outages seen over the last two days are happening for three main reasons:
-
Preemptive Isolation: Security organizations (including CERT-EU and multiple government IT infrastructure agencies) recommended isolating internet-facing applications until patches could be verified. Some organizations took down critical services to prevent automated exploitation.
-
Emergency Patching & Restarts: Applying core engine updates to thousands of web servers simultaneously forced widespread web server reboots and container redeployments.
-
Out-of-Memory Exploitation Attacks: Threat actors automated denial-of-service (DoS) and RCE probes targeting exposed file-upload handlers, crashing worker processes across web servers.
Affected PHP Versions
| Branch | Vulnerable Versions | Fixed In Version |
| PHP 8.5 | Pre-8.5.12 | 8.5.12 |
| PHP 8.4 | Pre-8.4.27 | 8.4.27 |
| PHP 8.3 | Pre-8.3.36 | 8.3.36 |
| PHP 8.2 | Pre-8.2.35 | 8.2.35 |
| PHP 8.1 & older | All EOL versions | No Official Fix (Upgrade Required) |
⚠️ Note on End-of-Life (EOL) Versions: The official PHP project does not backport security fixes to EOL versions (PHP 8.1, 7.4, 5.6, etc.). Systems running these versions remain permanently exposed unless using specific OS distributions with backported patches or third-party Extended Long Term Support (LTS).
Action Plan: How to Protect Your Servers
If you manage servers running PHP, take the following immediate steps:
1. Upgrade Core PHP Immediately
Update your system packages via your standard OS package manager (apt, yum, apk) or rebuild your container base images:
-
Ensure your runtime matches PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or higher).
2. Redeploy Cloud Runtimes & Containers
-
Docker / Kubernetes: Rebuild Dockerfiles pulling from updated base images and redeploy your pods/containers.
-
Serverless / PaaS (AWS, Google Cloud, Azure): Ensure runtime environments (App Engine, Cloud Run, Web Apps) are using updated platform stacks or redeploy custom runtimes.
3. Temporary Mitigation (If Patching Is Delayed)
If you cannot immediately update or isolate your web server:
-
Place a Web Application Firewall (WAF) in front of your applications to limit request body sizes and block malicious multipart form submissions.
-
Restrict access to public networks or isolate non-critical systems behind VPN / IP allowlists until patches are applied.
Login to comment
To post a comment, you must be logged in. Please login. Login
Comments (0)