Overview

PHP have published an advanced notification that there are two critical vulnerabilities being patched tonight. These are CVE-2026-109618 and CVE-2026-109619 and no details have been formally released yet.

Full details are set to be published on Thursday, 22 October 2026 at 12:00 am (AEST)

Details have now been published:

RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Is my website affected?

If it’s based on PHP, then yes. This includes WordPress, Joomla, Laravel and any other PHP based CMS or site using PHP scripting.

What does this vulnerability allow?

Essentially, they can completely take over your website with a single call.

What action is Conetix taking?

Our internal security team has been actively investigating these vulnerabilities since the initial announcement. We have been able to identify and implement additional security measures designed to prevent the exploitation of the vulnerabilities in CVE-2026-109618 and CVE-2026-109619.

Although these measures are expected to significantly reduce the risk, we cannot guarantee their effectiveness until the full details of the vulnerabilities are published.

Our team are on standby to immediately patch all systems once there is an update available.

Update: All Linux servers have been patched. All Windows servers have been patched.

Have any websites or servers been compromised?

We have been monitoring our systems heavily since the early announcement. At the time of writing, we have not identified any suspicious behaviour associated with this vulnerability. We expect attackers to increase their efforts to exploit once full details are published and will continue our heightened monitoring.

What versions of PHP are affected?

All versions from PHP 5 through to 8.5.

What versions of PHP will be patched?

As per PHP’s own guidance on supported PHP versions, only PHP 8.2, 8.3, 8.4 and 8.5 will be receive security updates from the PHP team. If your website is running an outdated version of PHP, we recommend working with your developer to immediately upgrade your PHP version. This may require some development time as well as plugin updates to ensure full compatibility.

We have more guidance within our article on supported PHP versions.

Update: PHP versions 7.4 – 8.1 have also now been patched. We still highly recommend moving to at least PHP 8.2

Further Reading

Was this article helpful?
Yes No

Related Articles