Remote Code Execution Vulnerabilities in PHP- (CVE-2026-109618 and CVE-2026-109619)

Vulnerability Detail –

On October 21, 2026, PHP disclosed two critical remote vulnerabilities in PHP.  Both have been patched in the PHP October 2026 security release. The bugs allow an attacker to exhaust PHP’s memory limit with a crafted multipart request, then interrupt the request cleanup at the right moment so that stale memory gets reused and allowing for RCE conditions.

The vulnerabilities will have wide reaching effects on other software which packages PHP in its deployments. Researchers have already demonstrated remote code execution in WordPress, Drupal, Joomla, phpMyAdmin and many other platforms using the default settings.

A public Proof-of-Concept exploit has also been made available now.  Experts are urging everyone to patch PHP deployments as well as any systems which use PHP right way.

MicroBilt Response –

Microbilt does not have any production platforms built on PHP.    Proactively, on October 21^st, Microbilt ran scans both internally and externally against its systems to check for these vulnerabilities and found that no systems were vulnerable.  Additionally, over the coming days we will continue to run scans to check for any systems that may run software using PHP and monitor for any indicators of compromise on those systems. We will continue to remain vigilant in monitoring activity on servers and platforms as well as maintaining a regular update and patch cadence on systems and software. 

Customer / Vendor Response -

MicroBilt has sent out a vendor vulnerability assessment questionnaire to all partners and vendors. Responses are being tracked in our vendor management system, and we continue to work with vendors and partners to collectively guard and mitigate against this CVE.  

For any customer or vendors using PHP, it is recommended:

· Patch PHP software deployments to the current October 2026 (Released Wednesday, 21 October 2026 at 14:00 UTC.)

· If you cannot patch immediately, the following temporary, partial mitigations may buy you some time:

• For PHP-FPM, disable session upload progress with session.upload_progress.enabled=0 and set memory_limit=-1.
• For mod_php, set memory_limit=-1.

· Find and patch any third-party software that bundles PHP as vendor updates come out.

A comprehensive list (though not exhaustive) of affected software can be found here:   https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md