PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026

* PHP released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities.
* The vulnerabilities are CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
* Vulnerabilities allow unauthenticated remote code execution.
* Affected systems include PHP-FPM, Apache with modphp, php-cgi, FrankenPHP, and LiteSpeed.
* PHP 8.1 and older versions do not receive updates from the PHP project.
* CVE-2026-115560 was published as an informational advisory regarding a partial bypass vector for CVE-2026-109619.
* Mitigation involves updating to fixed versions or applying runtime configuration changes, such as setting session.uploadprogress.enabled=0.
* CVE-2026-109618 involves RCE via out-of-memory corruption during request handling.
* CVE-2026-109619 involves RCE via stale global state in a long-lived worker model.

The narrative of coordinated disclosure involving the PHP security team, Snyk, and Linux distributions demonstrates a structured, albeit reactive, process for managing critical vulnerabilities. The focus shifts from just patching to defining where responsibility lies: updating the runtime versus configuring the application layer. This structure reveals a systemic challenge in maintaining security across diverse environments, especially when legacy versions persist or upstream support is withdrawn. The explicit distinction between what Snyk can see (declared dependencies) and what actual deployment includes (runtime execution) highlights a fundamental tension between declarative configuration and operational reality. The implication for human agency lies in the necessity of moving beyond reliance on automated scanning tools to deeply understand the deployed state, emphasizing that security is not merely about fixing code but understanding the system's execution context.
Bridge Questions: Given that upstream support has ceased for older PHP versions, what alternative, long-term strategies should organizations adopt to ensure sustained security when dealing with legacy dependencies? How can the industry better integrate findings from tools like Snyk with the operational realities of disparate deployment environments to bridge the gap between theoretical risk and actual exposure? What are the long-term governance structures required to enforce timely patching across complex software supply chains?