CyberSecurity Malaysia

1.0 Introduction
Recently, the PHP project has released security updates to address two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP.

2.0 Impact
Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to remotely execute arbitrary code on affected systems, potentially resulting in the compromise of these systems. CVE-2026-109618 arises when PHP handles an out-of-memory error and leaves request memory in an uninitialised state before the request cleanup procedure reads it. CVE-2026-109619 arises when the global state is not correctly reset and continues to refer to request memory after it has been freed, so subsequent requests may use stale state. The flaws are in PHP itself, so a site can be vulnerable even when its own application code is secure, and attackers could also read passwords, tokens and API keys from PHP process memory. This may lead to website compromise, installation of malware or web shells, theft of credentials and data, and system compromise.

3.0 Affected Products

PHP versions prior to 8.5.12
PHP versions prior to 8.4.27
PHP versions prior to 8.3.36
PHP versions prior to 8.2.35
PHP 8.1 and older, which no longer receive updates from the PHP project
All PHP versions from 5 onwards.
All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk for mod_php.

4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the following PHP security announcement and apply the necessary updates

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, so contact your distribution or LTS vendor for a backported fix, or upgrade to a supported version.
Identify systems running any version of PHP and apply the security updates, prioritising internet-facing systems. Check whether PHP is installed on web servers, including where it is used by third-party applications or components, even if the primary website does not use PHP.
If immediate patching is not feasible, consider isolating internet-facing applications from public networks until the security fixes are applied and verified.
PHP also lists temporary measures that reduce exposure to specific attack paths but do not make an installation safe, such as setting memory_limit=-1 so applications cannot override it, setting a low post_max_size, and setting session.upload_progress.enabled=0. Please refer to the PHP advisory for the full list.
Review web server and PHP logs for signs of compromise, and rotate credentials, tokens and API keys that may have been exposed.
Continue to monitor PHP’s official guidance for updates.

Kindly refer to the following URL:

https://www.php.net/archive/2026.php#2026-10-21-5
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my

5.0 References

Select User Category

Select User Category

Select User Category

Select User Category

Cyber999 Advisories

Critical PHP2Shell Vulnerabilities in PHP Allowing Unauthenticated Remote Code Execution

Search

Type

Archives