What the project disclosed
The PHP Foundation describes two related memory-safety failures in the PHP engine. One concerns out-of-memory cleanup that can leave partially initialized internal state; the other concerns stale global state after a fatal error. The same application can expose different paths depending on how PHP is configured and how requests reach the worker.
The project lists CVE-2026-109618 for the out-of-memory path and CVE-2026-109619 for the stale-state path. Wiz Research separately documents demonstrated code execution in selected configurations. A demonstration establishes feasibility, but it does not prove that a particular installation was exploited.
Where the decision sits
The project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address the two disclosed flaws. Operators should check the runtime version on each serving host, not just application lockfiles. Distribution packages may use backported fixes, so verify the vendor advisory and package changelog before deciding whether a version string is vulnerable.
Cloudflare reports deploying protection against known request patterns, while warning that some configurations are outside its rule coverage. A network rule cannot establish that the underlying engine has been repaired. The practical priority remains the PHP runtime update and replacement or restart of processes using the old binary.
What remains uncertain
Exposure depends on whether a susceptible PHP runtime handles attacker-controlled requests and whether the necessary request path is available. The project’s advisory and the linked research should guide configuration-specific checks. Public research and attack traffic are distinct from proof that any individual site was compromised.
Preserve relevant request and process logs if suspicious traffic appears, and investigate separately from patching. This report covers the two named engine CVEs; other PHP advisories require their own assessment.
Evidence and review
Incident date: Unknown. Evidence checked .
Merged by pankajmouriya · Editorial merge