Developing
CERT-EU says attacks are likely but reports no observed cases; the CVSS version and number of vulnerable installations are not stated.
In 60 seconds
- CVE-2026-109618 is memory corruption during out-of-memory handling; CVE-2026-109619 is stale global state that can carry over between requests. Both allow unauthenticated remote code execution.
- Affected: PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35, plus end-of-life branches 8.1 and older.
- Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; source backports exist for 7.4, 8.0 and 8.1.
- CERT-EU "strongly recommends updating all affected PHP installations as soon as possible"; memory limits and upload settings reduce exposure but "only an update fully fixes" them.
Impact Layer
- What changed
- A critical, easily triggered PHP flaw affects most sites running PHP, including WordPress.
- Why it matters
- A compromised site can be defaced, used to serve spam or malware and lose search visibility.
- Who is affected
- Site owners, WordPress administrators, hosting providers and SEOs.
- Martech stack area
- SEO & Search, CMS
- Stack impact
- Check your PHP version in your host's control panel and update to the fixed release, or ask your host. Do not rely on a plugin update.
- Business impact
- High PPC Land's reading of CERT-EU's Security Advisory 2026-018 and the NSA's advisory. Confirmed exploitation, the CVSS version, how many installations are vulnerable and the NSA's promised guidance are not stated.
- What to watch
- Reports of exploitation and host patch schedules.
PHP released fixes on October 21, 2026 at 13:30 UTC. CERT-EU published Security Advisory 2026-018 and the NSA issued its own advisory the same day, according to PPC Land.
The vulnerabilities
- CVE-2026-109618: memory corruption during out-of-memory handling; CVSS 9.2.
- CVE-2026-109619: stale global state that can carry over between requests; CVSS 9.2.
- Both allow unauthenticated remote code execution; one request can trigger the attack before application code runs.
Affected and fixed versions
Affected: PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35, plus end-of-life branches (8.1 and older). Fixed: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4, 8.0 and 8.1.
Recommended action
- CERT-EU “strongly recommends updating all affected PHP installations as soon as possible”.
- The NSA says that if an immediate update is not feasible, systems should go offline until mitigated; CERT-EU says to consider isolating internet-facing applications instead.
- Temporary mitigations (memory limits, upload settings, disabling upload progress sessions) reduce exposure, but “only an update fully fixes these vulnerabilities”.
Not stated
Confirmed exploitation (attacks are likely but none observed per CERT-EU), the CVSS version, how many installations are vulnerable and the NSA’s promised guidance.
Our read
If you run WordPress or any PHP site, this is a patch-today item. If you must take a site down, use a 503.
Sources
- PPC Land: PHP servers face two 9.2-rated flaws that let attackers run code (opens in a new tab)
Source for the vulnerabilities, versions, advice and what is not stated.