When government agencies across Europe abruptly pull their portals offline, the rest of the web pays attention. That is exactly what happened when two critical remote code execution vulnerabilities surfaced in PHP, pushing website operators into an urgent patch cycle.
If you manage web infrastructure, you already know why this caused immediate alarm. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severe CVSS score of 9.2 out of 10. They allow unauthenticated attackers to execute arbitrary code remotely over the internet without needing a password or valid account. A single malicious request can compromise a server before application code even executes.
Understanding the Vulnerabilities
The core issue stems from how PHP handles low-level memory operations during exceptional conditions. The first flaw involves memory corruption triggered during out-of-memory error handling via longjmp(). When PHP aborts a request that exceeds configured memory limits, it can leave internal request data partially initialized during form uploads or file parsing. Subsequent cleanup routines mistake invalid data for valid structures, allowing attackers to access memory regions left over from earlier allocations.
The second flaw revolves around stale global state management. When a fatal error occurs, internal state owned by a request can survive even after its underlying memory is freed. A later request handled by the same worker thread might use that stale state before normal initialization resets it. Combined, these bugs present a direct route to full system compromise across major hosting configurations like PHP-FPM, Apache mod_php, and LiteSpeed.
Why Government Websites Scrambled
Government services cannot afford extended downtime, but they risk catastrophic data exposure if left exposed. Agencies in the Netherlands, Finland, and France took administrative portals dark immediately as a precautionary measure. Danish municipal IT services suspended school communication platforms while system administrators audited local dependencies.
The widespread panic highlights a structural reality of the modern internet. PHP underpins a massive portion of global web traffic, powering heavy-duty content management systems like WordPress, Drupal, Joomla, and Magento. When a foundational server-side language stumbles, the shockwaves hit everything from municipal notice boards to national identity portals.
The Hidden Risk in Legacy Code
The most dangerous exposure isn't always the main production server you monitor daily. It's the forgotten marketing subdomain, the legacy staging environment, or the custom hosting control panel running outdated code.
PHP's development team released urgent patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, older branches like PHP 8.1 and earlier receive zero official updates from the PHP project. If you're running legacy installations that cannot be upgraded instantly, automated firewall rules or cloud proxy mitigations offer temporary relief, but they are not a substitute for a real patch.
What You Need to Do Right Now
Stop reading theory and start auditing your infrastructure. Take these concrete steps immediately:
- Inventory every server in your environment to identify exact PHP runtime versions. Pay close attention to embedded binaries inside appliances or secondary docker containers.
- Apply the official security updates immediately. Prioritize internet-facing assets exposed to unauthenticated public traffic.
- Isolate any legacy system running unsupported PHP versions behind strict access controls or take it completely offline until you can migrate or patch the underlying software.
- Review web server access logs for anomalous out-of-memory spikes or malformed request payloads that match early proof-of-concept signatures.
