PHP

PHP's Two 9.2-Severity RCE Flaws Turn Unauthenticated Requests Into Server Code Execution

By 苏琢玉 · Oct 22, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

PHP deployments on the public internet now have a patching deadline. Two unauthenticated RCE flaws in the runtime, combined with AI-assisted exploit development, make old, unmaintained PHP sites a much cheaper target than before.

Summary

PHP is getting attention for the wrong reasons. On October 21, PHP published patches for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities with CVSS scores of 9.2. Both can let an unauthenticated attacker execute code on a server through crafted HTTP requests. Japan's prime minister personally urged organizations to patch, the NSA recommended taking unpatched systems offline, and European cybersecurity agencies followed with joint warnings.

One flaw lives in PHP's out-of-memory handling. Certain multipart requests can exhaust PHP's memory limit during parsing, causing the runtime to abort early and then clean up half-initialized internal state, which leads to memory corruption and potentially RCE. The other is a use-after-free in the request lifecycle: when a worker process survives between requests, stale references to freed memory from a previous request can be accessed before the next request finishes initializing. Both bugs sit below application code, so affected sites can be vulnerable regardless of their business logic.

Google Cloud says AI models participated in the discovery and validation of the flaws. The same capability makes patch analysis and exploit development faster, narrowing the time defenders have to update. PHP's fixed releases are 8.5.12+, 8.4.27+, 8.3.36+, and 8.2.35+; versions 8.1 and older are outside standard support and need vendor-specific patch verification.

Takeaways

— CVE-2026-109618 and CVE-2026-109619 both carry CVSS scores of 9.2 out of 10.

— Both vulnerabilities can be triggered by unauthenticated network requests and can escalate to remote code execution on the server.

— CVE-2026-109618 is triggered by crafted multipart requests that exhaust PHP's memory during parsing; the runtime's abnormal cleanup path mishandles half-initialized internal state and causes memory corruption.

— CVE-2026-109619 is a use-after-free: after a fatal error in one request, a PHP worker process can keep stale references to freed memory, and the next request can access them before initialization completes.

— PHP's fixed versions are 8.5.12+, 8.4.27+, 8.3.36+, and 8.2.35+.

— PHP 8.1 and earlier are outside regular upstream support; patches may be backported by OS or commercial vendors, so the vendor's security advisory must be checked.

— Google Cloud said AI models took part in discovering and validating the two vulnerabilities.

— Japan's prime minister, the NSA, and European cybersecurity agencies all issued public warnings; some government and commercial sites took emergency maintenance or temporary shutdowns.

Conclusions

Runtime-level flaws are a bigger deal than business-logic bugs because PHP's cleanup and request lifecycle code runs before and around every application; a site can be vulnerable even if its own code is fine.

Google Cloud's use of AI in discovery has an offensive counterpart: the same model-assisted analysis that finds a bug can be pointed at a public patch to speed up exploit development, shortening the window for slow patchers.

National security agencies got involved because PHP's biggest exposure sits in unmaintained legacy systems; actively upgraded applications are a much smaller risk.

Concepts & terms

OOM (Out Of Memory)

A state where a process cannot allocate more memory. In CVE-2026-109618, hitting PHP's memory limit during request parsing triggers a flawed cleanup path that leaves internal state half-initialized.

Use After Free (UAF)

A memory safety bug where a program continues to reference memory after it has been freed. The freed memory may be reallocated, so the stale reference can read or write attacker-influenced data.

RCE (Remote Code Execution)

An attack that lets a remote user run arbitrary code on a target server. Both PHP CVEs can escalate from crafted HTTP requests to RCE through memory corruption.

multipart request

An HTTP body format used for forms and file uploads. Specially crafted multipart requests can force PHP's parser to allocate far more memory than the request size suggests.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗