PHP Memory Corruption Vulnerability
TL;DR 📌
- PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
- Listed in CISA KEV (2026-10-26) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-109618.
What it is
CVE-2026-109618 is a memory corruption flaw in PHP that allows unauthenticated remote code execution. The PHP Group has not published detail beyond this summary, so the specific component, module, or code path involved is not yet clear.
Because exploitation does not require authentication, the practical risk depends heavily on how PHP is deployed on a given system — anywhere PHP processes untrusted input over the network is worth reviewing until the vendor advisory fills in the mechanism.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-26, so it is known to be exploited.
No affected version range, fixed version, or CVSS score has been published yet. Anyone running PHP should treat this as an open, unpatched remote code execution issue until the PHP Group or NVD provides more detail.
What to do
- Check the advisory at the NVD link for CVE-2026-109618 regularly, as version and fix details are expected to follow.
- Inventory where PHP is running, particularly instances exposed to untrusted network input, since the flaw is unauthenticated and remote.
- Because this is in CISA KEV, federal agencies and KEV-tracking organisations should apply their standard KEV remediation timelines once a fix is available, and should flag this CVE now for tracking even before a patched version is published.
- Do not wait for a CVSS score to prioritise — KEV inclusion already indicates this is being treated as actively exploited.
- Subscribe to or monitor the PHP Group’s own security announcements, since the official advisory will carry the fixed version and affected release range that are currently missing from NVD.
For leadership 🧭
Executive summary. PHP itself has a memory corruption bug that lets an attacker run code remotely without logging in, and it is already on CISA’s exploited list. There is no fix, no affected version range and no severity score yet, so this needs attention today rather than waiting for the next patch cycle.
Why it matters:
- This sits in PHP itself rather than a plugin or application, so any site or service running PHP and handling network input is potentially exposed, not just one framework or CMS.
- No authentication is required, meaning an attacker only needs network access to a PHP-processing endpoint to attempt exploitation.
- CISA KEV listing confirms active exploitation is already happening, so this is not a theoretical risk awaiting proof.
- With no fixed version or affected range published, there is currently no patch to apply, which makes compensating controls the only available defence.
Now / Next / Later:
- Now: Inventory every system running PHP, especially those exposed to untrusted network input, and flag CVE-2026-109618 for tracking in your vulnerability management system today.
- Next: In your next change window, review network exposure of PHP-processing endpoints and tighten access or add filtering where internet-facing PHP cannot be taken offline, pending a vendor fix.
- Later: Once the PHP Group publishes affected and fixed versions, apply the patch under your standard KEV remediation timeline and confirm via the NVD entry that the fix addresses your deployed version.