Dear Customer,
We would like to bring to your attention two critical security vulnerabilities identified in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities may allow an unauthenticated attacker to execute arbitrary code on affected servers under certain conditions.
The vulnerabilities have been rated Critical, with a CVSS score of 9.2/10. Customers running affected PHP installations are strongly advised to take immediate action.
Technical Details : The vulnerabilities involve memory-handling issues within PHP that may lead to remote code execution (RCE):
- CVE-2026-109618 — Remote Code Execution via Out-of-Memory (OOM) Corruption: Improper handling of memory-allocation failures can leave internal request data in an inconsistent state, potentially allowing an attacker to exploit the affected PHP runtime.
- CVE-2026-109619 — Remote Code Execution via Stale Global State: PHP may retain references to memory that has already been released. Under certain conditions, subsequent requests handled by the same worker may access this stale state, potentially resulting in remote code execution.
Successful exploitation could compromise the affected PHP worker and potentially expose website data or other resources accessible to the process.
Official PHP Security Announcement and Fixed Versions.
Please refer to the official PHP security announcement for technical details, affected versions, and available security updates:
URL : https://www.php.net/archive/
Required actions we strongly recommend that you:
1, Identify all PHP versions installed on your server, including versions used by individual websites and applications.
2, Review the relevant operating system, PHP distribution, or hosting control panel vendor advisories.
3. Apply the appropriate vendor-supported security updates for all affected PHP installations.
4 Verify that the PHP services and applications are running with the required security fixes.
5. If a compatible security update is not available, restrict public access to affected applications where feasible and plan an appropriate upgrade or migration.
6. Review application compatibility before changing PHP versions, and test any required changes before deploying them to production.
Important Notes ,
- If your server does not use PHP and has no PHP-based applications or services installed, you may disregard this notification.
- If PHP is installed but is believed to be unused, please verify that no websites, background processes, or other services depend on it before deciding that no action is required.
- As your server is covered under an unmanaged service arrangement, operating system and application-level maintenance may be your responsibility, subject to our service agreement.
Please treat this advisory as a priority.
Thank you for your attention and cooperation in maintaining the security of your server environment.
