Threat Level Description

IthacaLabs has maintained the Threat Level (High) adding a new observation:

An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

Description

We have observed that new critical PHP vulnerabilities, that may expose affected web servers and applications to remote code execution, have been identified.

An attacker, depending on the affected PHP version, configuration, and application exposure, could possibly achieve to execute arbitrary commands on vulnerable systems.

Note that the actual impact depends on the PHP version, server configuration, process privileges, and application architecture.

These critical vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

CVE-2026-109619: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Affected Products:

• PHP 8.5 - Versions earlier than 8.5.12
• PHP 8.4 - Versions earlier than 8.4.27
• PHP 8.3 - Versions earlier than 8.3.36
• PHP 8.2 - Versions earlier than 8.2.35

Recommendation(s)

You should proceed immediately and apply the relevant security patches provided by the vendor and/or update to the latest versions of PHP software that are not affected by these vulnerabilities.

Note that patches are only available for currently supported PHP versions (8.2 and later). If you are running an end-of-life PHP version (8.1 or earlier), no official patch will be available and you should plan an immediate upgrade to a supported version.

If immediate patching is not possible, assess exposure and apply appropriate temporary mitigations until the update can be completed.

Furthermore, internet-facing systems should be prioritized for assessment and remediation. The vulnerability exists in the PHP runtime itself, so updating a CMS or application alone does not resolve the issue.

You should understand the importance of security updates, and the urgency with which they should be applied, no matter how large or small your organization is. It is very important to apply an efficient patch management solution and always have enabled an active event security logging and practice event monitoring. To protect the valuable assets of your business and be compliant with the relevant industry regulations requires a comprehensive approach to the management of risk, including Penetration Testing at least annually and upon significant changes.

Threat Level Description:

Threat Level: High – An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

References:

CVE-2026-109619

CVE-2026-109618