As you have surely seen via threat feeds or in the media, two vulnerabilities in the PHP framework were disclosed on October 21st, and patched versions were released on the same day.
The vulnerabilities
- RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Official PHP information: https://www.php.net/archive/2026.php#2026-10-21-5
Vendor information
To determine whether any products from our portfolio are affected, we have compiled a list of the various manufacturers here:
- Fortinet: https://www.fortiguard.com/psirt/FG-IR-26-186
- Palo Alto Networks: https://security.paloaltonetworks.com/CVE-2026-109618, Signature Update 9162 contains vulnerability signatures.
- WatchGuard: https://psirt.watchguard.com/WGSA-2026-0032
- Fudo: Fudo Enterprise is not affected by CVE-2026-109618 and CVE-2026-109619. This applies to all Fudo Enterprise releases from 5.4 to 6.2.3. Fudo Enterprise does not include the PHP interpreter, and no Fudo Enterprise component runs PHP code. Customers do not need to update or reconfigure Fudo Enterprise because of these vulnerabilities.