PHP RCE Flaws Affect Versions 5–8: Fixed Releases and Mitigation Options

Two flaws in Core PHP can turn error handling into a path to remote code execution. The issues, CVE-2026-109618 and CVE-2026-109619, affect PHP versions 5 through 8, and each has a CVSS v4.0 score of 9.2. For teams running PHP, the practical priority is to identify the runtime and vendor package in use, then apply a release containing the relevant fix.

The PHP Foundation fixed both issues in PHP 8.2 and later, with releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35 listed as patched versions. Some distribution maintainers and long-term support vendors may have backported the fixes to older package lines. Check with the vendor for the status of the exact build you deploy; a version number alone may not tell the whole story when packages include vendor changes.

How the two flaws arise

Both vulnerabilities involve PHP using longjmp() to leave the current execution context after an error. That mechanism interrupts normal request handling. The problem described in each case is that some code paths don't fully account for the abrupt exit, leaving memory in a state that later processing can mishandle.

CVE-2026-109618 concerns out-of-memory conditions. When PHP encounters one, it can use longjmp() to abandon the current context and stop handling the request. In certain contexts, request memory may then remain uninitialized. During cleanup, PHP may read that memory or make a decision based on it. The source says multiple out-of-memory strategies can reliably trigger the condition and lead to remote code execution.

CVE-2026-109619 follows a related pattern after fatal errors. The jump out of the current context can leave global memory in an invalid state, with a reference to memory that is freed when the request ends. A later request may read or branch on that stale reference. The source says more than one triggering strategy is possible. It doesn't provide further details about the specific inputs or prerequisites, so operators should use the vendor's advisory for implementation-level guidance as it becomes available.

The shared mechanism matters for triage: these aren't described as flaws in a particular application framework or a single PHP extension. They are in Core PHP's handling of exceptional request paths. The source identifies versions 5–8 as affected, while the listed patched releases begin at PHP 8.2. Teams on older branches should verify whether their package provider has supplied a backport or whether a source-level fix is available for their build.

Patch status and deployment choices

For PHP 8.2 and later, the stated fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Where a supported upgrade path is available, moving to a fixed release addresses the issue at the runtime level. The source also says some distributions and long-term support vendors provide backported fixes, which can let teams receive a correction without switching to a newer major or minor PHP line.

PHP's security team provided minimal source backports for PHP 7.4, 8.0, and 8.1. These are aimed at people who build PHP from source or lack access to a long-term support vendor. That option brings more responsibility for maintainers: teams need to apply the relevant changes, build the runtime, and confirm that deployed instances use the corrected build. The source doesn't describe a supported package route for every older installation, so the next step depends on how PHP is obtained and maintained in each environment.

Both CVEs were published on October 21, 2026, according to the source. Its guidance is to patch vulnerable installations once a fix is available. Since package availability can differ by distribution and support provider, verify the status of the actual production package before treating an upgrade or backport as complete.

What a WAF rule can and can't do

Fastly says its Next-Gen WAF team created a rule customers can enable directly in the WAF dashboard. The CVE-specific templated rule covers both vulnerabilities and looks for request bodies and parameters whose structure differs from legitimate traffic, as possible signs of attempts involving the PHP flaws. Fastly describes this as temporary protection while customers wait to patch.

That makes the rule a mitigation layer, not a replacement for a corrected PHP runtime. Its detection depends on recognizing patterns in incoming requests, while the underlying weaknesses occur in PHP's memory handling during error paths. Teams using the rule still need to confirm it is enabled for the relevant applications and plan a runtime update or vendor backport. The source doesn't provide detection rates, performance measurements, or details about possible false positives, so operators should review observed traffic and rule behavior in their own setup.

Fastly's product information is available through its Next-Gen WAF page. The company also describes its response in a post about the PHP flaws and offers customer support.

What PHP teams should check next

Start with an inventory of PHP versions and package sources across application environments, including systems that may not follow the main upgrade cadence. Confirm whether each package is fixed directly or carries a vendor backport. For source-built runtimes, review the available backport guidance and ensure the resulting build reaches every instance that handles requests.

Then treat the WAF rule as an interim control where it fits your deployment, and keep patch work on the schedule. The useful distinction for teams is between reducing exposure at the request boundary and correcting the vulnerable error-handling paths in the runtime. The version and vendor details will determine the shortest route to a fixed build; continued monitoring of PHP's support and release information will clarify options for older branches.