Wiz Research: Critical Remote Code Execution Vulnerabilities Discovered in PHP

Wiz Research has discovered critical memory safety and remote code execution vulnerabilities affecting versions of the core PHP engine released over the last decade, which powers 70 percent of websites. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities allow unauthenticated attackers to execute remote code on platforms such as WordPress, Drupal, and Joomla. The PHP team released patches addressing the security flaws on October 21, 2026.

The vulnerabilities identified by Wiz Research stem from issues in how PHP handles fatal errors and out-of-memory conditions encountered while processing requests. These errors can lead to a corrupted internal PHP state remaining after an unexpectedly terminated request. When a subsequent request or worker reuses this stale state, memory disclosure or corruption can occur.

The vulnerability tracked as CVE-2026-109618 leads to remote process memory disclosure via an upload progress serialization flaw, while the bug tracked as CVE-2026-109619 causes OPcache type confusion and corruption of the shared PHP state due to debugging stack trace issues. Exploitation of these security vulnerabilities enables unauthenticated remote code execution on popular platforms such as WordPress, Drupal, and Joomla.