CVE-2026-109618/109619: PHP fixes two unauthenticated RCE flaws
Two critical PHP flaws can enable remote code execution before application code runs. Inventory both web servers and products embedding PHP, then update immediately.
Updated: · Vietnam time (UTC+7)
The PHP project's 21 October 2026 advisory was cross-checked against UK NCSC, CERT-EU and Unit 42's 23 October update. Verified applies to the vulnerabilities, fixed releases and attributed reporting, not to scope beyond the provider's telemetry. Unit 42 reports one post-exploitation case at a European government entity; Ransomware.VN has not examined original logs, telemetry or samples and has not verified ransomware, a Vietnamese victim or a total number of affected organizations.
Sources were read on 24 October 2026. NCSC and CERT-EU rely in part on PHP's advisory and are not presented as independent incident confirmation. Unit 42's 22.6 million figure is exposed instances potentially vulnerable in its telemetry, not victims or confirmed compromises. Its hunting query is not specific to these CVEs and may produce false positives. Artwork is editorial illustration, not incident evidence.
Evidence: two CVEs and fixed releases
On 21 October 2026, the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution under applicable conditions. PHP 8.1 and older are end-of-life at the upstream project; organisations should check for vendor backports or move to a supported branch. [S1]
Technical evidence: memory flaws before the application layer
CVE-2026-109618 involves out-of-memory handling that can leave request data only partially initialised before cleanup treats it as valid. CVE-2026-109619 involves stale global state surviving after its backing memory has been freed and later being used by a worker before normal initialisation. [S1][S3]
PHP's stated scope includes every installation serving web requests, such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The project rates mod_php as the highest-risk setup and reports a demonstrated path where one unauthenticated request triggers the flaw before application code runs. [S1]
Verification scope: PoCs do not prove a campaign
CERT-EU says technical discussion and initial PoCs have begun circulating and assesses that exploitation likelihood has increased. This is a risk assessment, not confirmation of an active campaign. The reviewed sources do not publicly connect these CVEs to ransomware, a named victim or a system in Vietnam. [S3]
Technical assessment: inventory and update first
- Inventory every PHP runtime serving web requests, prioritising Internet-facing assets. Do not limit discovery to obviously old versions because the advisory spans branches before the fixed releases.
- Check appliances, management portals, backup software and third-party products that may embed PHP. Treat a product as affected only when its version or vendor advisory supports that conclusion.
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a distribution/LTS package with the backported fix. Verify the installed package rather than relying on a version banner alone.
- If updating is not yet possible, consider isolating the service from the Internet. PHP's temporary measures do not make an installation fully safe and do not replace the patch. [S1][S2]
Response assessment: preserve evidence before change
For exposed systems that remained unpatched during a relevant window, preserve access logs, error logs, configuration, processes, scheduled tasks and file changes before upgrading or rebuilding. Search for web shells, backdoors and follow-on activity in a timeline; successful patching is not proof that earlier access did not occur. [S2]
Where a service cannot be patched or sufficiently reduced in exposure in time, the UK NCSC advises considering taking it offline until fully addressed. The decision should account for business continuity and be approved by an authorised owner. [S2]
What remains unknown in Vietnam
Ransomware.VN has no primary telemetry, original logs or public-source notice confirming exploitation of these CVEs at a Vietnamese organisation. This is an Exposure Watch alert for inventory and defence, not a victim count or a claim that a ransomware incident occurred.
24 October update: Unit 42-reported post-exploitation telemetry
Unit 42 says it observed agentic-AI post-exploitation at one European government entity: within two hours of initial exploitation, the actor accessed password hashes and MFA secrets, established an NTLM-relay tunnel into Active Directory and attempted Domain Admin escalation. This is provider-reported observation, not independent verification by Ransomware.VN. [S4]
Cortex Xpanse identified more than 22.6 million exposed instances potentially vulnerable at publication time. This is exposure telemetry, not a count of unique organizations, confirmed victims or systems known to be compromised. [S4]
Unit 42's hunting query looks for post-exploitation command execution from PHP workers, but is not specific to these two CVEs and may produce false positives. Validate each match against expected workloads, process ancestry, the incident timeline and original logs before drawing conclusions. [S4]
Sources
Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.
Update history
· Published a VI/EN alert from PHP and government cyber guidance, separating PoCs, risk assessment and unverified scope, with six event-specific minimalist images.
· Adjusted further reading to avoid promoting the retired No.Ransomware.VN brand. Facts, URL, publication date, sources and artwork are unchanged.
· Added Unit 42's 23 October telemetry on one post-exploitation case, exposed instances and hunting queries, preserving source scope rather than turning it into a victim count or ransomware/Vietnam confirmation. URL, publication date and six images retained.
Corrections policy
