NCSC: PHP Security Update Fixes Remote Code Execution Vulnerabilities
PHP has issued a security update addressing a critical vulnerability that could allow attackers to execute commands on web servers running the scripting language, the National Cyber Security Centre reported.
Out-of-Memory Conditions and Memory Corruption Risks
The flaw involves how PHP handles out-of-memory situations, which can trigger memory corruption on vulnerable servers. Under specific conditions, this corruption allows unauthenticated remote code execution. PHP operates as a widespread server-side scripting language handling backend application logic, database interactions, and dynamic web page generation before delivering HTML output to user browsers.
Two distinct common vulnerabilities and exposures identifiers track the flaws. CVE-2026-109618 occurs when out-of-memory handling interrupts PHP while internal request data remains only partially initialized. Subsequent request cleanup routines can mistakenly treat this invalid data as valid information. CVE-2026-109619 involves request-owned internal state surviving after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
NCSC Monitors PHP Vulnerability Impact on UK Organizations
The security issue affects any web server or product utilizing vulnerable PHP versions to manage application logic. The National Cyber Security Centre stated it will continue monitoring the situation to determine any direct impact on organizations across the United Kingdom. Separate institutional monitoring by the National Cyber Security Centre, which operates as an operational arm of the Department of the Justice, Home Affairs and Migration and encompasses the State’s National/Governmental Computer Security Incident Response Team (CSIRT-IE), emphasizes incident response preparedness for critical national infrastructure providers.
Administrators managing affected server environments must apply the official security updates immediately to close the remote code execution vector.
Because PHP is widely used across the web, the UK’s National Cyber Security Centre (NCSC) has advised all organisations running PHP to take immediate action.Several iniBuilds services, including our community forum, use PHP and were therefore within scope of this advisory.3/8
More on National Cyber Security Centre
The NCSC: pls patch php omg plsAlso the NCSC: gets hacked hour 1 of patch release pic.twitter.com/WWtaO5pTzT