PHP CVE-2026-109618 permits remote code execution without login

Key points

• PHP Group's PHP carries CVE-2026-109618, a high-severity flaw.
• Exploitation can yield remote code execution without credentials.
• Memory corruption and out-of-memory faults are part of the impact.
• Agencies should deploy vendor fixes, follow BOD 26-04, and retire unsupported instances.

PHP Group has published details for CVE-2026-109618, a high-severity defect in PHP. The flaw can be exploited by an attacker who can reach the service to achieve remote code execution that needs no authentication. The same issue involves memory corruption and out-of-memory conditions that can corrupt memory, raising the risk of crashes as well as code execution.

Any organization that runs PHP should assume it may be affected until proven otherwise. In K-12 and government settings, PHP often sits behind student portals, staff applications, and public-facing web services, so exposure can be broad even when the vulnerable component is not obvious. Teams should first determine which instances are reachable from the internet and which support sensitive workflows.

An unauthenticated code-execution path is serious because it can turn a web-facing service into an initial foothold. Attackers could run commands, read or alter data, or pivot to other systems. The memory-corruption and out-of-memory aspects also mean defenders may see service instability, repeated crashes, or resource exhaustion that looks like ordinary reliability trouble.

BOD 26-04 sets a patching expectation that agencies should follow. PHP Group's mitigations should be deployed immediately where available, and the patched release should be applied on the required timeline. If a deployment cannot be mitigated, the safer course is to stop using it rather than leave it exposed. Exposure review should be repeated after changes.

Watch for exploit attempts in web logs, unusual processes on PHP hosts, and spikes in memory-related failures. Prioritize internet-facing instances, confirm inventory accuracy, and document any temporary compensating controls until patching is complete.

What to do now

1. Inventory every PHP instance and label which ones are reachable from the public internet; prioritize those for immediate action.
2. Deploy the PHP Group's mitigations now, then apply the patched release as soon as it is available.
3. Track remediation against BOD 26-04's required timeline and document exceptions with risk acceptance.
4. If no mitigation or patch exists for a given deployment, remove it from service or retire the component rather than leaving it exposed.
5. Add temporary compensating controls—WAF rules, network ACLs, or reverse-proxy restrictions—for internet-facing PHP services.
6. Hunt logs for exploit attempts and for crashes, out-of-memory events, or unexpected child processes on PHP hosts.
7. Recheck exposure after changes and verify that only required PHP endpoints remain publicly reachable.

Original source

CISA Known Exploited Vulnerabilities