Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R01

R01: Remote code execution on internet-facing PHP servers

Because two flaws in the PHP engine let an unauthenticated request execute code on a default Apache mod_php setup, an attacker who reaches an unpatched server can take it over, resulting in data theft, defacement or a foothold in the network behind it.

Rating 15 high · Likelihood 3 Possible · Impact 5 Severe · Kind Security · Acceptance not recorded

Basis. Impact: unauthenticated code execution, confirmed on mod_php. Likelihood: probing confirmed, attempts reported, no confirmed compromise; attack complexity high.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Organisations running PHP	owner	Only the organisation running the server can update it or take it offline.	26 risks
People who use PHP services	bearer	Their data and their services are what an attacker reaches.	5 risks
The PHP project	treater	Ships the fix in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.	11 risks
Hosting and cloud providers	treater	Patch the runtime for every customer on a managed platform.	4 risks
Edge, WAF and detection vendors	treater	Filters and detection between the attacker and the server.	8 risks
Agencies and CERTs	informer	Their advisories set how urgently boards act.	11 risks

The risks this one is made of

Risk	Rating	Kind	Assigned to	Controls
R01-3 Versions the PHP project no longer fixes stay vulnerable	20 critical	Security	Organisations running PHP owner, Hosting panels and paid long-term support treater, Linux distributions and image builders treater, CTO owner, CFO bearer	NIST SP 800-53 SA-22, CIS Controls 2.2, NIST CSF 2.0 PR.PS-02, Cyber Essentials SUM +1
R01-6 Products that embed PHP stay vulnerable while their suppliers investigate	16 high	Supply chain	Suppliers in the NCSC-NL inventory owner, Organisations running PHP bearer, EU and member-state CERTs informer, CTO owner	Cyber Resilience Act Art.13, Cyber Resilience Act AnnexI.II, OWASP Top 10s A03:2025, NIS2 Art.21(2)(d) +4
R01-1 Default Apache mod_php installations exploited before application code runs	15 high	Security	Shared and self-service hosting owner, Website owner bearer, Platform engineers and developers treater	ISO/IEC 27001 A.8.8, CIS Controls 7.4, Cyber Essentials SUM, PCI DSS 6.3.3
R01-4 The fix is incomplete, or a third flaw follows	15 high	Security	The fix authors owner, The PHP security team treater, Organisations running PHP bearer, Platform engineers and developers bearer, The finders informer	NIST SSDF RV.3, NIST SSDF PW.8, ISO/IEC 27001 A.8.29, ISO/IEC 29147 and 30111 30111:handling
R01-5 Popular applications compromised before authentication	15 high	Security	Open-source PHP applications informer, Website owner owner, Online shops and payments bearer	OWASP Top 10s A06:2021, PCI DSS 6.3.1, CIS Controls 16.4
R01-2 PHP-FPM deployments wrongly treated as safe or as certainly vulnerable	12 high	Security	Security lead and AppSec owner, Managed PHP platforms treater, The PHP security team informer	NIST CSF 2.0 ID.RA-01, ISO/IEC 27001 6.1.2

What it arises from

The allocator's longjmp-based bailout on out-of-memory. An out-of-memory error unwinds by longjmp and can leave request memory in a state that cleanup later reads.
Request globals that survive a failed request. State from a request that failed is still there when the next one starts.

The evidence

Claim	Status	Fact-check	Sources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35	confirmed	A6 Established	CVE record CVE record PHP PHP php.net
Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs	confirmed	A6 Established	PHP oss-security php.net
Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on out-of-memory, and request globals that survive a failed request	confirmed	A6 Established	php/php-src, read from a clone PHP PHP
Triggering the bug is much easier than turning it into code execution; the CVSS vector says attack complexity high	confirmed	A3 Echoed	Imperva Threat Research Fastly CVE record
Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe	confirmed	A6 Established	php.net oss-security PHP

Treatments

Treatment	Status	Where
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35	in place	Patching: which versions get a fix, and from whom
Take the system offline where an update is not possible (CISA, NSA)	in place	Impact: taken offline versus compromised
Edge filters while the update is rolled out	partial	Detection and defence: what blocks php2shell and what shows it

The standards that govern it

Framework	Control	What it asks	Family
ISO/IEC 27001	A.8.8	Management of technical vulnerabilities	Management-system standards
NIST CSF 2.0	ID.RA-01	Vulnerabilities in assets are identified, validated and recorded	Frameworks and control catalogues
NIST SP 800-53	SI-2	Flaw remediation	Frameworks and control catalogues
CIS Controls	7.7	Remediate detected vulnerabilities	Frameworks and control catalogues
MITRE ATT&CK	T1190	Exploit public-facing application	Practice and technique
OWASP Top 10s	A06:2021	Vulnerable and outdated components	Practice and technique
NIS2	Art.21(2)(e)	Security in acquisition, development and maintenance, including vulnerability handling and disclosure	Law and regulation

The stories that tell it

On this site: The two flaws: CVE-2026-109618 and CVE-2026-109619 · The fix, mapped to the code · If you run PHP: the steps, in order, with their sources