What happened
On 2026-10-21 the PHP project disclosed two critical unauthenticated RCE flaws (CVE-2026-109618 premature-exit memory corruption on OOM; CVE-2026-109619 stale cross-request global state -> use-after-free). CISA added both to KEV on 2026-10-26 with confirmed exploitation; Cloudflare reported millions of exploit attempts and AWS said probing began days before patches. By 2026-10-22 Mirai botnet operators joined the attacks as ASLR-bypass exploits emerged.
Why it matters
PHP hosts a large share of the web front-ends and admin surfaces that wrap AI/ML services — model-marketplace UIs, MLflow/vector-DB dashboards, and AI plugin ecosystems. Because the corruption fires in request shutdown before application authentication, no app-level control blocks it; an RCE on the web tier can pivot into the data plane that feeds AI workloads.
Attack vector
Unauthenticated crafted HTTP requests (multipart lacking valid Content-Length, unbounded per-part headers) trigger request-shutdown memory corruption / cross-request use-after-free before application code runs; leads to DoS, memory disclosure, or remote code execution. Confirmed in the wild and added to CISA KEV on 2026-10-26.
Affected systems
PHP 8.2 <8.2.35, 8.3 <8.3.36, 8.4 <8.4.27, 8.5 <8.5.12 (CVE-2026-109618 memory-corruption RCE and CVE-2026-109619 stale-request-state UAF RCE); no fix on EOL branches
Mitigation
Patch to PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. If not immediately upgradeable: memory_limit=-1, cap request-body sizes/multipart parts/headers, and disable session.upload_progress on PHP 8.5. Rebuild/roll container images to patched PHP-FPM.