Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Unit 42 has identified two critical remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS 4.0. CVE-2026-109618 allows attackers to achieve RCE by exploiting improper control flow during out-of-memory error handling via longjmp(), leaving request memory uninitialized. CVE-2026-109619 enables RCE by causing global memory to point to freed memory regions during fatal error handling, which can be later accessed or executed. Proof-of-concept exploits exist, and over 22.6 million internet-exposed PHP instances are potentially vulnerable, prompting urgent patching recommendations.

AI-extracted · verify before operational use