Three unpatched memory flaws in PHP let anyone on the internet run code on your server before your application even knows a request arrived. No login or session is required. A malformed request turns your WordPress, Drupal, or Joomla site into a beachhead.
The PHP project disclosed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026. Both relate to how PHP handles memory during out-of-memory conditions and when internal state goes stale. A third flaw, CVE-2026-115560, surfaced two days later and remains unaddressed by the initial patches. These flaws expose the machinery beneath millions of websites to unauthenticated remote code execution.
How Memory Errors Become Server Takeovers
CVE-2026-109618 triggers when PHP mishandles memory allocation during an out-of-memory error. CVE-2026-109619 exploits similar confusion around stale internal state and memory management. In both cases, an attacker crafts a request that forces PHP into a corner. The engine corrupts its own memory layout instead of failing cleanly. That corruption opens a window where injected code runs with the privileges of the web server process, before any application-level authentication or routing fires.
The attack happens at the runtime layer. Your CMS never sees it. Your firewall rules probably do not catch it. The request looks malformed enough to trigger the error path, but not obviously malicious enough to trip standard WAF heuristics.
The Discovery and the October 17 Problem
Security researchers found these flaws by probing PHP’s memory-management internals. They used AI agents to correlate behavior across error conditions and build working exploits. This methodology signals where vulnerability research is heading: human intuition sets the direction, and automated analysis scales the search across code paths no single researcher would manually trace.
Amazon detected exploitation attempts on 17 October, four days before public disclosure. The attackers already knew. The gap between weaponization and patching is shrinking, whether from independent discovery, supply-chain leakage, or monitoring of the PHP development process itself. For defenders, this means the old rhythm of “disclose, then patch, then scan” is broken. By the time you read the advisory, someone has already tested your perimeter.
What Needs Patching Now
The PHP project released fixes on 21 October across four branches:
| Branch | Patched Version |
|---|---|
| 8.5.x | 8.5.12 |
| 8.4.x | 8.4.27 |
| 8.3.x | 8.3.36 |
| 8.2.x | 8.2.35 |
If you run anything older, including unmaintained 8.1.x or 7.x releases, you are exposed and will not receive fixes. Upgrade paths for legacy applications need immediate attention, not quarterly planning.
Third-party bundles complicate this. WordPress hosts using managed PHP through cPanel, Plesk, or cloud platform runtimes must verify their provider has pulled the update. Docker images, Laravel Forge deployments, and embedded PHP in network appliances all need separate checks. The vulnerability is in the runtime, not your application code, so your deployment pipeline may hide the version actually serving traffic.
CVE-2026-115560 and the Unfinished Fix
The 23 October disclosure of CVE-2026-115560 falls outside the 21 October patch set. The PHP project has not yet shipped a fix. Organizations should monitor php.net/archive/2026.php for updates and consider additional mitigations: strict request size limits, reduced memory limits where application behavior allows, and heightened logging on error paths that might trigger the vulnerable conditions.
Immediate Actions
1. Identify your PHP version. Use `php -v` on the command line, or a phpinfo() output if you need the runtime a web server sees. These often differ. 2. Upgrade to the patched release for your branch, or migrate to a supported branch if you are end-of-life. 3. Audit third-party products that embed PHP. Check vendor advisories for CMS platforms, hosting control panels, and appliance firmware. 4. Review logs from 17 October onward. Look for unusual request patterns, memory exhaustion errors, or crash reports that correlate with external traffic. The Canadian Centre for Cyber Security advisory AL26-026 and CERT-EU advisory 2026-018 provide IOC guidance. 5. Plan for CVE-2026-115560. Assume it will be exploited before patches arrive. Restrict attack surface where possible.
The Harder Lesson
These flaws reward organizations that can patch in hours, not weeks. If your deployment still requires change boards, manual testing environments, and weekend maintenance windows for runtime updates, an unauthenticated RCE with pre-disclosure exploitation activity has already outpaced your process. The infrastructure that lets you ship a WordPress plugin update in minutes should also apply to your PHP runtime. If it does not, that gap is now measurable in compromised servers.
