Critical security issue affecting PHP

What has happened?

PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.

PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases and handle backend application logic before delivering the final page to a visitor’s browser. WordPress, WooCommerce and many other website platforms are built on PHP, and it is also used in a range of other products.

The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.

• CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partially initialised. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

The full PHP security advisory provides more details about the fixed issue, and the NCSC will continue to monitor for any impact.

Who is affected?

Organisations using any version of PHP are affected, and all organisations are highly encouraged to update to the latest fixed version. Anyone still running an older version of PHP is highly encouraged to move to a fully supported version.

What should I do?

The NCSC recommends following vendor best practice advice, and highly encourages organisations to follow these priority actions:

1. Find every system running PHP, starting with anything that faces the internet, such as your website. As all versions may be affected, don’t limit this to outdated versions of PHP.
2. Update to the latest version of PHP and keep monitoring for future updates.
3. If you can’t update yet, apply the temporary mitigations provided by the PHP Foundation.
4. If you can’t apply the mitigations, or they would take too long, consider taking the system offline until it can be fully fixed.
5. If you can’t update or take the system offline straight away, check it for any signs of compromise, including backdoors installed by an attacker, before you upgrade. If you’re not confident doing this yourself, get help from a specialist such as an NCSC-assured Cyber Incident Response provider.
6. Keep watching for updates from other software vendors, including appliances and services that include PHP. NCSC-NL has published an inventory of software products with a PHP dependency that may be affected. Apply updates as they become available.

Further NCSC resources

• NCSC blog post: Preparing for a ‘vulnerability patch wave’
• NCSC guidance on vulnerability management and preventing lateral movement
• NCSC principles for secure build and deployment pipelines
• UK organisations can sign up to the free NCSC Early Warning service to receive notifications of potential threats on their network
• The NCSC Vulnerability Disclosure Toolkit helps organisations of all sizes set up a vulnerability disclosure process

Source: NCSC, “Critical security issue affecting PHP”. Photo by Jakub Żerdzicki on Unsplash.