PHP issues emergency fixes for two critical RCE flaws: CISA and UK NCSC issue urgent alerts (21 Oct 2026)

PHP issues emergency fixes for two critical RCE flaws: what the advisories establish

The PHP Group has released out of band security updates addressing two critical remote code execution vulnerabilities in core PHP request processing: CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a CVSS 4.0 base severity score of 9.2. The flaws, designated by researchers as "PHP2Shell", reside in the Zend Engine's request initialization and memory management logic. Because the vulnerability triggers during initial request intake before user scripts, framework routers, or authentication middleware execute, an unauthenticated remote attacker can trigger memory corruption by sending crafted HTTP requests directly to any exposed PHP application.

The UK National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) have both issued urgent alerts recommending that public and private sector organisations patch immediately. In its alert, the UK NCSC notes that internet facing web applications running vulnerable PHP versions are at direct risk of compromise, while CISA has alerted federal civilian agencies to prioritize patching internet exposed services. The patched releases are PHP 8.3.13 and PHP 8.2.25, with corresponding backports issued by major enterprise Linux distributions including Debian, Ubuntu, and Red Hat Enterprise Linux.

Technical breakdown: memory management and fatal error recovery

The root cause of both vulnerabilities stems from how the Zend Engine handles fatal errors and out of memory conditions during request initialization. When PHP receives an incoming HTTP request via FastCGI or mod_php, it allocates request specific memory structures before invoking the targeted script. If an inbound request forces an early allocation failure or parser error, the engine raises a fatal error and invokes zend_bailout. Under the hood, zend_bailout relies on the C standard library setjmp and longjmp primitives to abort execution and return control to the top level request loop.

In CVE-2026-109618, performing a non local jump out of deeply nested request parser frames leaves internal request hash tables and string buffers partially initialized. When PHP's request shutdown sequence attempts to free these structures, it mistakes uninitialized pointers for valid allocated memory, resulting in an exploitable write what where primitive. In CVE-2026-109619, persistent worker pools such as PHP-FPM fail to fully invalidate dangling pointers following a fatal jump, allowing a subsequent request handled by the same worker process to manipulate freed heap segments.

Because the corruption takes place within the native C memory space of the worker daemon, modern exploit payloads achieve remote code execution by overwriting function pointers in the Zend executor globals table. Once overwritten, the next stage of request cleanup transfers instruction control to attacker controlled shellcode or memory addresses.

Global attack surface and the 14 year code baseline

The scale of the vulnerable surface is substantial. Telemetry published by Palo Alto Networks Unit 42 indicates that approximately 22.6 million internet exposed hosts currently respond with PHP application headers or services. While many modern cloud architectures run PHP inside containerized microservices behind load balancers, millions of public facing web instances remain directly accessible via standard web ports.

Git commit history indicates that the vulnerable zend_bailout cleanup sequence was introduced during the development of PHP 5.4.0, which was officially released on 1 March 2012. Between that initial release and the 21 October 2026 emergency disclosure, exactly 5,347 days have elapsed (14.6 years, derived). Although active security support for PHP 5.x and 7.x ended years ago, millions of legacy servers running unmaintained releases share this vulnerable code path and will not receive upstream security patches.

Comparison of facts established by official advisories versus unconfirmed assumptions.

Topic	What is stated in official records	What is not established
Exploitation in the wild	The PHP Group and UK NCSC state that the flaws were discovered and reported by security researchers. CISA has not added the CVEs to its Known Exploited Vulnerabilities catalogue at initial advisory release.	Whether private exploit brokers or state sponsored groups possessed weaponised exploits prior to public disclosure.
Affected versions	Officially confirmed in PHP 8.3 prior to 8.3.13 and PHP 8.2 prior to 8.2.25. Upstream security backports have been provided for supported branches.	Whether unofficial third party backports will be reliably created for end of life installations such as PHP 7.4 or 5.6.
WAF mitigation	The UK NCSC notes that web application firewalls may detect known exploit payloads but cannot guarantee complete protection against mutated request structures.	Whether generic WAF rules can prevent exploitation without generating unacceptable false positive rates on valid large uploads.
Execution context	Code execution occurs within the security context and system user privileges of the PHP worker daemon (such as www-data or apache).	Whether secondary local privilege escalation flaws exist to elevate from worker privileges to root access.

UK NCSC and CISA defensive recommendations

In its technical bulletin, the UK NCSC categorizes the vulnerabilities as a critical threat to internet facing infrastructure. The agency recommends that organisations immediately identify all external facing systems running PHP, verify current package versions, and deploy vendor updates within 24 to 48 hours. The bulletin emphasises that simply updating the installed package on disk is insufficient: administrators must actively restart all PHP worker services to ensure that running daemons reload the patched shared libraries.

Operational checklist for systems engineering and security teams

Key facts at a glance