PHP Ships Critical RCE Fixes Across Four Branches

This is a serious infrastructure-level incident disguised as a routine point release: vulnerable PHP can expose otherwise-secure applications before application code even runs.

• –CVE-2026-109618 and CVE-2026-109619 affect memory handling and error-state management, with demonstrated exploitation against web-serving configurations.
• –Apache mod_php faces the highest risk, but PHP-FPM, CGI, FrankenPHP, and LiteSpeed deployments also require investigation and patching.
• –Configuration workarounds are incomplete; upgrading to the fixed branch versions and restarting long-running workers is the only reliable remediation.
• –Container images and distribution packages may lag behind upstream, so teams should verify the actual runtime and package changelog rather than assuming an application upgrade is sufficient.
• –PHP 8.2 reaches end of life on December 31, 2026, making this a strong prompt to plan migration to a newer supported branch.