Pinguin working on Servers Image © DALL-EPinguin working on Servers (Image © DALL-E)

The Security Advisory highlights two critical vulnerabilities that expose systems to the risk of remote code execution (RCE) if an attacker sends specially crafted network traffic.

CVE-2026-109618: Memory Management Flaw

This vulnerability results from the improper handling of out-of-bounds memory accesses when processing incoming requests. If the PHP interpreter does not properly manage out-of-bounds memory accesses, it creates an opportunity for remote attackers to execute arbitrary code on the host server.

CVE-2026-109619: Improper Management of Internal Request States

The second vulnerability involves the improper management of internal request states when reusing worker processes. Because the state is not properly reset or isolated between reused worker processes, a remote attacker could exploit this inconsistency to trigger the execution of arbitrary code.

System Impact and Risk Assessment

If these vulnerabilities are not patched, they allow an external attacker to send malicious network packets to a server running the affected PHP versions. The main risks include:

  • 1. Remote Code Execution (RCE): Attackers can execute unauthorized programs with the privileges of the PHP process.
  • 2. System instability: The vulnerabilities can be exploited to crash the PHP interpreter, resulting in a denial-of-service (DoS) condition.

Required Updates and Version Information

To mitigate these risks, administrators must update their systems to the latest package versions. The fix affects several components, including the CGI, CLI, and FPM binaries, as well as the Apache module.

Ubuntu 26.10 (Stonking)

For users of version 26.10, the following packages must be updated to version 8.5.9-0ubuntu2.1:

  • php8.5-cgi
  • php8.5-cli
  • php8.5-fpm
  • libapache2-mod-php8.5

Ubuntu 26.04 LTS (Resolute)

Users of version 26.04 LTS must update these packages to version 8.5.4-0ubuntu1.5:

  • php8.5-cgi
  • php8.5-cli
  • php8.5-fpm
  • libapache2-mod-php8.5

Ubuntu 24.04 LTS (Noble)

For version 24.04 LTS, the required update is version 8.3.6-0ubuntu0.24.04.13 for the following packages:

  • php8.3-cgi
  • php8.3-cli
  • php8.3-fpm
  • libapache2-mod-php8.3

Ubuntu 22.04 LTS (Jammy)

Users of version 22.04 LTS must upgrade the following packages to version 8.1.2-1ubuntu2.28:

  • php8.1-cgi
  • php8.1-cli
  • php8.1-fpm
  • libapache2-mod-php8.1

Remediation Instructions

System administrators should run a standard system update to install these security patches. This process ensures that all affected PHP packages are updated to the secure versions listed above. If these components are not updated, the infrastructure is vulnerable to remote attacks via the CVE-2026-109618 and CVE-2026-109619 vectors. It is also recommended to take the systems offline until the patches are applied.