What shipped. The PHP security team published two critical advisories this morning (GHSA-w8hw-w9fx-j79w, “RCE via OOM corruption,” and GHSA-6wmf-4rv5-p3rp, “RCE via stale global state”), both rated CVSS v4.0 9.2. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release, though the team posted minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Every way of serving web requests is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php highest risk, with a demonstrated exploit that fires “before any application code runs” (per BleepingComputer).
How it works. Both CVEs come from the same design flaw. When a request dies abnormally, usually from an out-of-memory fatal, PHP can leave the worker holding pointers into request memory that has already been freed. The next request on that worker reads the stale state before normal init resets it. Wiz chained four variants: an upload-progress unserializer use-after-free, a session-ID leak that dumps worker memory into the PHPSESSID cookie, a fatal-error backtrace use-after-free and an OPcache type confusion. The trigger is cheap. Multipart requests can hit OOM while staying inside post_max_size by dropping the content length, stuffing a part with unlimited headers, or nesting empty file fields that don’t count toward max_file_uploads. Wiz says it got pre-auth RCE on stock wordpress:latest, drupal:latest and joomla:latest containers, and that a “Hello World” page on a vulnerable build is enough.
Why this one is different. The memory-disclosure path matters as much as the RCE. An attacker who never gets a shell can still read passwords, session tokens, API keys and certificates from other users’ requests, the same way Heartbleed worked. Wiz found the first bug on Aug 19 using its own tooling plus Google and OpenAI frontier models, and says the models turned a decade-old, very hard-to-exploit bug class into working exploits “in hours.” Quarkslab is also credited on the disclosure, per Cloudflare.
Exploitation status. Cloudflare says its WAF rules went live for free and paid plans at 03:02 UTC Oct 21 (8:02 PM PT Tuesday). After details leaked ahead of the release it saw attack traffic aimed at customers, with payloads being mutated to get around the rules. A public proof-of-concept repo is already on GitHub. When we checked this morning, CVE-2026-109618 and CVE-2026-109619 weren’t in CISA’s KEV catalog yet. Confirmed victims: Undisclosed.
The response is unusually blunt. The UK NCSC told organizations to patch now or “consider taking the system offline,” and the NSA posted similar advice on X. The BBC reports that Finland temporarily shut its government’s public web services and that the Dutch cyber agency took its own website offline. PHP core developer Gina Peter Banyard says there is no mitigation that replaces the patch. Cloudflare, Akamai, Fastly, Imperva, AWS, Google, Microsoft and Vercel all helped prepare virtual-patching guidance, but every one of them treats it as a stopgap.
The buyer angle. This is a runtime-inventory problem, not an app-patch problem. Your WordPress plugins can be fully current and you can still be exposed because the hole sits in the interpreter underneath them. The hard cases are PHP you don’t own directly: vendor appliances and control panels that bundle their own runtime, base container images that pin an old minor version, and managed hosting where you have to wait on the provider. For the vuln-management and CNAPP vendors, this is a live test of whether “agentless runtime inventory” can actually answer which PHP, where, serving traffic by lunchtime.
What we’d do this morning. Patch internet-facing PHP first, mod_php hosts ahead of FPM, and rebuild images instead of patching running containers in place. Confirm your WAF or CDN rule set for PHP2Shell is enabled in block mode, not log. Then hunt the way Wiz describes: unusual multipart requests followed by memory-limit errors or bursts of HTTP 500s, oversized or garbled PHPSESSID response cookies, and unexplained PHP worker churn. Because the memory leak exposes secrets in transit, plan to rotate the session signing keys, API tokens and DB credentials those web tiers handle on anything that was exposed and unpatched. EOL 7.x/8.0/8.1 hosts get the source backport, an LTS vendor build, or isolation. Leaving them alone isn’t an option.