Summary
Two critical vulnerabilities in PHP let an unauthenticated attacker run code with the privileges of the PHP process by sending crafted HTTP requests to an affected PHP endpoint.
If you run a CleanStart php or drupal image older than the fixed tags listed below, or a custom image running an affected PHP release, update to a patched version immediately.
What happened
On 21 October 2026, PHP released fixes for both vulnerabilities. Public exploit code appeared around the same time.
- CVE-2026-109618, remote code execution via out-of-memory corruption. A request body that pushes PHP past memory_limit while it is being parsed leaves internal request data partially initialized. Cleanup then works on that invalid state.
- CVE-2026-109619, remote code execution via stale global state. PHP’s global state can be left pointing at request memory that has already been freed. The next request handled by the same worker uses that stale state.
The two flaws have distinct failure paths in the PHP runtime. Updating application code, Drupal core or modules does not fix either one; the PHP runtime itself must be patched.
Impacted packages and versions
Branch | Affected |
8.5 | below 8.5.12 |
8.4 | below 8.4.27 |
8.3 | below 8.3.36 |
8.2 | below 8.2.35 |
8.1 and older | all |
Am I affected?
You are affected if:
- The PHP version is below the fix line for its branch, per the table above. A tag name is a label; check the binary.
Resolution
Status as of 27 October 2026, from the tag listings on images.cleanstart.com and Docker Hub. Every fixed tag below was published on or after 24 October 2026, after PHP's 21 October release.
php
Branch | Fixed tags | VEX status | Earlier tags, affected |
8.5 | 8.5.12, 8.5.12-dev, 8.5.12-r0, 8.5.12-r0-dev | fixed | 8.5.11-r0, 8.5.8, 8.5.4 and their -dev variants |
8.4 | 8.4.27-r0, 8.4.27-r0-dev | fixed | 8.4.23, 8.4.19 and their -dev variants |
8.3 | 8.3.36-r0, 8.3.36-r0-dev | fixed | 8.3.33, 8.3.32 and their -dev variants |
8.2 | 8.2.35-r0, 8.2.35-r0-dev | fixed | 8.2.32 and its -dev variant |
drupal
Fixed tags | VEX status | Earlier tags, affected |
11.4.11, 11.4.11-dev, 11.4.11-r0, 11.4.11-r0-dev, 11.3.20-r0, 11.2.14-r0, 11.1.10-r0 and their -dev variants | fixed | 11.3.16, 11.3.16-dev |
CVE IDs, CWE and references
Identifier | PHP advisory | Description |
CVE-2026-109618 | GHSA-w8hw-w9fx-j79w | RCE via out-of-memory corruption during request cleanup |
CVE-2026-109619 | GHSA-6wmf-4rv5-p3rp | RCE via stale request-owned global state reused by a later request |