Updated:
Status:
CVEs:
Fortra is actively researching critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) that could allow an attacker to execute code remotely. CVE-2026-109618 is an out-of-memory corruption vulnerability where invalid data can be treated as valid during the request cleanup. CVE-2026-109619 is a stale global state vulnerability where a worker may reuse a stale state after its backing memory is freed before it is reset. The primary recommendation is to update to a fixed or supported PHP version.
Who is affected?
The following PHP versions are affected:
- PHP 8.5 before 8.5.12
- PHP 8.4 before 8.4.27
- PHP 8.3 before 8.3.36
- PHP 8.2 before 8.2.35
- PHP 8.1 and earlier
What can I do?
Update to one of the following versions or later:
- PHP 8.5: update to version 8.5.12 or later
- PHP 8.4: update to version 8.4.27 or later
- PHP 8.3: update to version 8.3.36 or later
- PHP 8.2: update to version 8.2.35 or later
- PHP 8.1 and earlier: update to a supported version
- Linux distributions may have backported fixes into earlier versions; see vendor for details.
For additional information, refer to:
How is Fortra helping me?
Fortra is actively researching this threat to build detection capabilities.
Updates
Fortra has kicked off the Emerging Threats process for this vulnerability. This article will be updated with new information about this vulnerability and related security coverage as it becomes available.
