PHP deployments running public-facing government services need an immediate patch review after two newly disclosed vulnerabilities that can lead to remote code execution. For agencies, the practical question is not simply whether a web server uses PHP, but where the runtime appears across legacy portals, vendor-hosted applications, container images and systems maintained by contractors.
The National Vulnerability Database published CVE-2026-109618 and CVE-2026-109619 on Oct. 21. The first carries a CVSS 3.1 score of 9.8 and a Critical rating; the second is scored 8.1 and rated High. Both involve PHP request-memory handling and can, under the conditions described in the records, produce remote code execution. That makes the flaws a potential route to compromise of the confidentiality, integrity and availability of an affected application.
CVE-2026-109618 concerns how PHP exits a request after an out-of-memory error. The NVD record says some contexts can leave request memory uninitialized before a later allocation, allowing cleanup logic to read or branch on that memory. CVE-2026-109619 involves global state that can continue to reference request memory after it has been freed. The affected PHP releases identified in the records are versions earlier than 8.2.35, 8.3.36, 8.4.27 and 8.5.12; older branches require especially careful review because their community-support status may differ.
For a government organization, an exposed PHP runtime could sit behind a constituent-services portal, permitting system, benefits application, public-safety information site or internal application that accepts data from outside users. A successful server-side compromise could create a foothold for data theft, service disruption or lateral movement. The NVD records describe the technical conditions for exploitation, not confirmed compromises at government agencies, so security teams should not infer that an affected installation has already been breached.
The first operational task is asset discovery. Teams should inventory PHP versions across production and staging environments, including appliances and managed applications where the runtime may not be visible in a normal server inventory. They should then map each version to the patched releases, verify that the deployed package actually changed, and use application and web-server logs to investigate unusual behavior. Upload restrictions, least-privilege filesystem access and segmentation can reduce exposure, but they do not correct the vulnerable runtime.
Perforce Zend argues that patching should be paired with a plan for applications that cannot move immediately to a current PHP version. “Patching these vulnerabilities is the immediate priority, but organizations also need a plan for the PHP applications they cannot upgrade straight away. Long-term support can give teams breathing space to migrate safely while continuing to receive security fixes,” said Matthew Weier O’Phinney, a PHP Foundation board member and product manager at Perforce Zend.
That advice is most relevant to agencies with applications whose dependencies, custom code or procurement constraints make an immediate upgrade risky. Commercial long-term support can be one option where it covers the required version and supplies the relevant fixes, but it should be treated as a transition control rather than an end state. Agencies should confirm coverage and patch availability, schedule compatibility testing, define a rollback plan and fund a move to a community-supported release. The immediate response is patching; the longer-term security outcome depends on reducing the number of unsupported runtimes that remain in service.