Critical Remote Code Execution Vulnerability (CVE‑2026‑109618) in PHP Allows Unauthenticated Attackers to Execute Code
What It Is — The PHP Group has disclosed a memory‑corruption flaw (CVE‑2026‑109618) that can be triggered when the interpreter runs out of memory. The condition enables an unauthenticated remote attacker to execute arbitrary code on the host running the vulnerable PHP version. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. The CVSS vector scores the issue as Critical (≥9.0), and no official patch has been released at the time of reporting.
Affected Products — PHP interpreter (all supported versions prior to the forthcoming patch).
Why It Matters for Trust & Control Assurance — This flaw directly tests the “vulnerability‑management” control objective: organizations must continuously discover, assess, and remediate known exploited weaknesses to maintain defensible audit evidence.
Recommended Actions —
- Inventory all systems running PHP and identify version numbers.
- Apply any available vendor patches or mitigations immediately; if none exist, implement temporary hardening (e.g., limit memory allocation, disable unnecessary extensions).
- Integrate the CVE into your continuous vulnerability‑scanning tools and ensure remediation status is captured as evidence for audits.
- Update your change‑management and incident‑response playbooks to include this specific exploit scenario.
Source: CISA KEV – CVE‑2026‑109618