- Course
Critical PHP Remote Code Execution Flaws: What You Should Know
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated remote code execution. Learn how they work and how to respond.
Beginner
- Course
Critical PHP Remote Code Execution Flaws: What You Should Know
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated remote code execution. Learn how they work and how to respond.
Beginner
Get started today
Access this course and other top-rated tech content with one of our business plans.
Try this course for free
Access this course and other top-rated tech content with one of our individual plans.
This course is included in the libraries shown below:
- Security
What you'll learn
CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities in PHP core, each rated CVSS v4.0 9.2. Disclosed together following an unusual advance notice and leak of technical details, the flaws prompted emergency PHP security updates. Both can potentially allow unauthenticated remote code execution, but they arise from different memory-handling failures.
CVE-2026-109618 concerns unsafe cleanup after out-of-memory recovery, while CVE-2026-109619 involves stale internal state that can persist across requests. PHP has confirmed exploitability in specific server configurations, including Apache mod_php. Risk varies by deployment, and unsupported PHP branches require particular attention.
In this episode, Matt Lloyd Davies and Michael Teske explain the vulnerabilities in plain language, examine affected environments, and discuss practical response priorities. Where technically validated, a short lab demonstration will illustrate the underlying behavior and the effect of remediation. Viewers will learn how to identify PHP installations, verify fixed versions and vendor backports, prioritize emergency patching, and monitor for suspicious activity.
Critical PHP Remote Code Execution Flaws: What You Should Know
Beginner
Table of contents
Matt has a degree in Chemical engineering and a PhD in mathematical chemistry. He is also a GIAC certified incident handler and penetration tester and has regulated cyber security in the UK civil nuclear sector for many years.
Michael Teske is an Author Evangelist with Pluralsight helping people elevate their skills. He has 20+ years of experience in IT Ops, including 17 as an IT instructor at a community college.
