Critical RCE Vulnerabilities Discovered in Core PHP: CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619: What you need to know

• What are they? Two critical (CVSS v4.0 scores of 9.2) vulnerabilities, CVE-2026-109618 + CVE-2026-109619 discovered in Core PHP. 

• What are the impacts? Left unpatched, the vulnerabilities leave Core PHP (all versions 5-8) vulnerable to remote code execution (RCE).

• What should you do? The PHP Foundation has patched CVE-2026-109618 and CVE-2026-109619 in PHP 8.2 and up (specifically versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version. PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. In the meantime, Fastly customers can opt in to our WAF rule to get temporary protection.

What are CVE-2026-109618 and CVE-2026-109619? 

On October 21, 2026, two CVEs, CVE-2026-109618 + CVE-2026-109619, were released to address critical vulnerabilities found in Core PHP, a foundational form of the PHP programming language. Both CVEs have a CVSS v4.0 score of 9.2, meaning they are critical vulnerabilities, requiring immediate attention and mitigation.

CVE details

CVE-2026-109618 - RCE via OOM
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

CVE-2026-109619 - RCE via fatal errors
PHP uses longjmp() for fatal errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave global memory in an invalid state, pointing into memory that is freed at the end of the request. Subsequent requests may read or branch on this memory. Multiple strategies can trigger.

What are the impacts of CVE-2026-109618 + CVE-2026-109619? 

Failure to patch the two vulnerabilities leaves Core PHP vulnerable to remote code execution (RCE). We urge our customers, and anyone else reading this post, to patch vulnerable versions immediately, once a patch is available. 

What Fastly is doing about it

Our Next-Gen WAF team crafted a set of rules that customers can enable. In order to access the virtual patch, customers must opt in to the rules directly in the WAF dashboard.

This should help provide some protection while you wait for an official patch. 

How Fastly can help

We know our customers entrust us with the resilience of their business-critical services, and core to our company's mission is to have your back when surprises like CVE-2026-109618 and CVE-2026-109619 strike. Our teams are here for you as these vulnerabilities evolve – whether you’re a longstanding Fastly platform customer or new and in need of immediate protection. Reach out for additional help!