# Special edition: CVE-2926-109618 (Update \#2)

> PHP fixes are out; exploitation attempts are reported, and FPM isn't exempt

- Series: It's Probably Nothing
- Special edition: CVE-2926-109618
- As of: 2026-10-21T20:40:14.868Z
- [Subject history and latest update](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff)
- Publisher: Sierra Echo Charlie
- Edition date (Pacific/Auckland): 2026-10-22
- Edition number: 8
- Status: Published edition
- Language: en-NZ
- [Canonical web edition](https://ipn.nz/special-editions/d3b75aac-ef48-485f-8d2f-f27d2a1d6fff/3cfa11e1-89eb-4dd9-8e6a-0dba4491d3f8)
- [Download PDF](https://ipn.nz/pdf/IPN-special-3cfa11e1-89eb-4dd9-8e6a-0dba4491d3f8.pdf)
- [MP3 audio](https://ipn.nz/audio/IPN-special-3cfa11e1-89eb-4dd9-8e6a-0dba4491d3f8.mp3) (3:27, 3316549 bytes)
- [Standalone transcript](https://ipn.nz/transcripts/special-3cfa11e1-89eb-4dd9-8e6a-0dba4491d3f8.md)

## Opening

PHP’s leaked core flaws have moved from embargo drama to a patching job. Fixes are available, and FPM isn’t a blanket exemption. This assessment is current to 09:40 NZDT on 22 October, or 07:40 AEDT.

## 1. What changed

Since our previous assessment, PHP has published fixes, technical advisories and both CVE records. watchTowr now reports active exploitation attempts against both vulnerabilities. That’s an attributed observation, not independently verified successful compromises or a measured global campaign. Some legacy installations also have backport routes.

### Sources

- [PHP — Security advisory: Critical remote code execution vulnerabilities, update now](<https://www.php.net/>) — primary source
- [CVE-2026-109618 — PHP CNA record](<https://cveawg.mitre.org/api/cve/CVE-2026-109618>) — primary source
- [CVE-2026-109619 — PHP CNA record](<https://cveawg.mitre.org/api/cve/CVE-2026-109619>) — primary source
- [PHP2Shell: PHP Remote Code Execution Exploited](<https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/>) — primary source
- [php2shell: Patched PHP packages available in testing](<https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/>) — primary source

## 2. An older discovery, an early leak

CVE-2926-109618 appears to be a typo in a quoted watchTowr post; PHP’s published identifier is CVE-2026-109618.

Wiz says it reported the vulnerabilities on 24 August. Their existence leaked on Hacker News on 20 October; PHP subsequently scheduled fixes for 21 October at 14:00 UTC. That was the announced schedule, not an established actual release minute.

### Sources

- [PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early](<https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-2026-109619-rce.html>) — reporting/context
- [Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming](<https://news.ycombinator.com/item?id=50167754>) — primary source
- [Upcoming Critical PHP Security Release](<https://news-web.php.net/php.announce/509>) — primary source
- [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](<https://www.wiz.io/blog/php2shell-php-rce>) — primary source
- [CVE-2026-109618 — PHP CNA record](<https://cveawg.mitre.org/api/cve/CVE-2026-109618>) — primary source

## 3. FPM isn’t off the hook

Both bugs carry official CVSS v4.0 scores of 9.2. CVE-2026-109618 leaves partially initialised memory reachable after an out-of-memory abort. CVE-2026-109619 leaves freed request state available for a later request in the same worker to consume. Neither is an application-framework bug.

PHP places all installations serving web requests in the at-risk population. mod\_php has the highest demonstrated risk, including exploitation before application code runs. For CVE-2026-109618, PHP confirms complete HTTP RCE against mod\_php, but says a complete FPM exploit hasn’t been demonstrated.

The second flaw has confirmed RCE paths against both mod\_php and FPM. The validated FPM path requires a suitable application operation after request startup, so configuration and application behaviour matter. “Every PHP site falls instantly” overstates the evidence; “we use FPM” doesn’t settle it either.

Successful exploitation runs code with the web worker’s privileges, not automatically as root. PHP also confirms memory disclosure for the stale-state flaw.

### Sources

- [RCE via OOM corruption](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>) — primary source
- [RCE via stale global state](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>) — primary source
- [PHP — Critical remote code execution security advisory](<https://www.php.net/>) — primary source
- [PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet](<https://www.wiz.io/blog/php2shell-php-rce>) — primary source
- [Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities](<https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities>) — primary source

## 4. Check the package and the running worker

Upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older: Ubuntu 24.04’s 8.3.6-0ubuntu0.24.04.13 fixes both. Check the full package build, not just the upstream-looking version.

PHP has supplied minimal source backports for 7.4, 8.0 and 8.1 without restoring normal support. AlmaLinux’s 17:50 UTC update on 21 October puts its 7.4 fix in production and its other shipped streams in testing.

### Worth asking

If you’re on Laravel Forge, automatic security updates don’t cover PHP. Update each installed version, verify the repository offers a fixed build and restart long-running PHP processes. PHP says updating is the only complete solution; configuration switches block particular paths, not the whole problem.

### Sources

- [PHP — Security advisory and update instructions](<https://www.php.net/>) — primary source
- [CVE-2026-109618 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109618>) — primary source
- [CVE-2026-109619 \| Ubuntu](<https://ubuntu.com/security/CVE-2026-109619>) — primary source
- [php2shell: Patched PHP packages available in testing](<https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/>) — primary source
- [PHP security advisory (CVE-2026-109618, CVE-2026-109619) — Laravel Forge](<https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026>) — primary source

## Audio transcript

Narrated using an AI voice.

Kia ora, this is a special edition of It's Probably Nothing. PHP's two leaked core vulnerabilities have moved from embargo drama to a patching job. Fixes are available, and FPM isn't a blanket exemption. This assessment is current to 9:40am New Zealand daylight time on 22 October.

Since our last assessment, PHP has published fixes, technical advisories and both vulnerability records. watchTowr now reports active exploitation attempts against both flaws. That's an attributed observation, not independently verified successful compromises or a measured global campaign. Some legacy installations now have backport options too.

The timeline starts before the leak. Wiz says it reported the vulnerabilities on 24 August. Their existence leaked on Hacker News on 20 October, and PHP subsequently scheduled fixes for 14:00 UTC on 21 October. That was the announced schedule, not an established actual release minute.

Both flaws have official CVSS version four scores of 9.2. The first leaves partially initialised memory reachable after an out-of-memory abort. The second leaves freed request state available for a later request in the same worker to consume. These are PHP core bugs, not application-framework bugs.

PHP puts all installations serving web requests in the at-risk population. mod\_php has the highest demonstrated risk, including exploitation before application code runs. For the first flaw, PHP confirms complete remote code execution over HTTP against mod\_php, but says a complete FPM exploit hasn't been demonstrated.

The second flaw has confirmed remote code execution paths against both mod\_php and FPM. The validated FPM path requires a suitable application operation after request startup, so configuration and application behaviour matter. “Every PHP site falls instantly” overstates the evidence; “we use FPM” doesn't settle it either. Successful exploitation runs code with the web worker's privileges, not automatically as root. PHP also confirms memory disclosure for the second flaw.

The upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older: Ubuntu 24.04 has a package fixing both vulnerabilities while retaining an older upstream version number. Check the full package build, not just the upstream-looking version.

PHP has also supplied minimal source backports for 7.4, 8.0 and 8.1, without restoring normal support. AlmaLinux's update at 17:50 UTC on 21 October puts its 7.4 fix in production, with its other shipped streams still in testing.

If you're on Laravel Forge, automatic security updates don't cover PHP. Update each installed version, verify that the repository offers a fixed build, and restart long-running PHP processes.

PHP says updating is the only complete solution. Configuration switches can block particular paths, but not the whole problem.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.

## Publisher

Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com).

Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)