Brand ClaimErleben, was verbindet

Advisory 2026-3994 - PHP: Multiple Vulnerabilities allow code execution

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2026-3994
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
5
Attack probability
high
4
Potential damage
medium-high
remote anonymous attackerExploit available
Date
2026-10-21
Release
2026-10-30 UPDATE

Operating System

  • Linux
  • UNIX
  • Windows

Software

  • Open Source PHP
  • UPDATE 2026-10-22
  • Amazon Linux 2
  • Checkmk Checkmk < 2.3.0p51
  • Checkmk Checkmk < 2.4.0p38
  • Checkmk Checkmk < 2.5.0p17
  • cPanel cPanel/WHM
  • cPanel cPanel/WHM < 11.110.0.153
  • cPanel cPanel/WHM < 11.134.0.66
  • cPanel cPanel/WHM < 11.136.0.50
  • cPanel cPanel/WHM < 11.138.0.18
  • Debian Linux
  • F5 BIG-IP
  • Fedora Linux
  • Gentoo Linux
  • Google Cloud Platform
  • Open Source Arch Linux
  • Open Source Matomo < 5.14.2
  • Open Source PHP 5
  • Open Source PHP 7
  • Open Source PHP < 8.2.35
  • Open Source PHP < 8.3.36
  • Open Source PHP < 8.4.27
  • Open Source PHP < 8.5.12
  • Oracle Linux
  • Red Hat Enterprise Linux
  • RESF Rocky Linux
  • SUSE Linux
  • Ubuntu Linux
  • UPDATE 2026-10-23
  • IBM QRadar SIEM
  • UPDATE 2026-10-26
  • SUSE openSUSE
  • UPDATE 2026-10-27
  • IBM App Connect Enterprise
  • Wibu-Systems CodeMeter

Attack

A remote, anonymous attacker can exploit multiple vulnerabilities in PHP in order to disclose memory, trigger a Denial of Service condition or execute arbitrary code.

Description

PHP is a widely-used programming language for the implementation of Web applications.

CVE-2026-109618, CVE-2026-109619

Multiple critical vulnerabilities exist in PHP. An out-of-memory vulnerability occurs when a request reaches the memory limit at a critical point, leaving partially initialized internal data that PHP later treats as valid and uses in a way that corrupts memory. The stale-global state vulnerability occurs when a fatal error leaves a pointer to memory from a previous request, which is then used by a later request handled by the same worker, causing a heap use-after-free. Under certain conditions, a remote, anonymous attacker can exploit these vulnerabilities to disclose memory, trigger a Denial of Service condition or execute arbitrary code with the privileges of the web worker.

CVSSv2 Base Score: 10.0 / Temporal Score: 8.7
AV:N/AC:L/AU:N/C:C/I:C/A:C/E:H/RL:OF/RC:ND
CVSSv3.1 Base Score: 9.8 / Temporal Score: 9.4
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:X

According to multiple reports, the vulnerabilities are already being exploited.

Recommendation

The developers announced an update for 21 October 2026 at 14:00 UTC. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.php.net/archive/2026.php#2026-10-20-1

UPDATE 2026-10-22

There is currently no update or patch available to fix this vulnerability.
https://www.php.net/archive/2026.php#2026-10-21-5

Arch Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://security.archlinux.org/ASA-202610-1

tribe29 provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://checkmk.com/werk/19262

Google provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://docs.cloud.google.com/support/bulletins#gcp-2026-070

cPanel & WHM Documentation provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://docs.cpanel.net/changelogs/110-change-log/

cPanel & WHM provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://docs.cpanel.net/changelogs/134-change-log/

cPanel & WHM Documentation provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://docs.cpanel.net/changelogs/136-change-log/
https://docs.cpanel.net/changelogs/138-change-log/

Rocky Enterprise Software Foundation provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://errata.build.resf.org/RLSA-2026:87070
https://errata.build.resf.org/RLSA-2026:87071
https://errata.build.resf.org/RLSA-2026:87072
https://errata.build.resf.org/RLSA-2026:87079
https://errata.build.resf.org/RLSA-2026:87151

Oracle Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://linux.oracle.com/errata/ELSA-2026-87070.html
https://linux.oracle.com/errata/ELSA-2026-87071.html

SUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030008.html
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030009.html

Oracle Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://linux.oracle.com/errata/ELSA-2026-87151.html

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.debian.org/debian-lts-announce/2026/10/msg00042.html

Matomo provides information.
https://matomo.org/changelog/matomo-5-14-2/

F5 provides information.
https://my.f5.com/manage/s/article/K000163821

Ubuntu provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://ubuntu.com/security/notices/USN-8948-1
https://ubuntu.com/security/notices/USN-8948-2

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://security-tracker.debian.org/tracker/DSA-6574-1

Arch Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://security.archlinux.org/ASA-202610-2

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:87070
https://access.redhat.com/errata/RHSA-2026:87071
https://access.redhat.com/errata/RHSA-2026:87072
https://access.redhat.com/errata/RHSA-2026:87073
https://access.redhat.com/errata/RHSA-2026:87079
https://access.redhat.com/errata/RHSA-2026:87080
https://access.redhat.com/errata/RHSA-2026:87151

Amazon provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html

Fedora provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9354b8a1e
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9eba4bbc3
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449

Gentoo provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://bugs.gentoo.org/984631

PHP provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.php.net/archive/2026.php#2026-10-21-5

cPanel provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:87414

Oracle Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://linux.oracle.com/errata/ELSA-2026-87080.html

UPDATE 2026-10-23

Rocky Enterprise Software Foundation provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://errata.build.resf.org/RLSA-2026:87073

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:88533
https://access.redhat.com/errata/RHSA-2026:88532

IBM provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.ibm.com/support/pages/node/7293670

Oracle Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
http://linux.oracle.com/errata/ELSA-2026-87073.html
http://linux.oracle.com/errata/ELSA-2026-87079.html

SUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030018.html
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030019.html
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030025.html
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030034.html

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:88565
https://access.redhat.com/errata/RHSA-2026:88561

UPDATE 2026-10-26
https://access.redhat.com/errata/RHSA-2026:88835

Google provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://docs.cloud.google.com/support/bulletins#gcp-2026-072

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:88659
https://access.redhat.com/errata/RHSA-2026:88693
https://access.redhat.com/errata/RHSA-2026:88720
https://access.redhat.com/errata/RHSA-2026:88725
https://access.redhat.com/errata/RHSA-2026:88834

openSUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YZRCJS4A4MBLLEJL6SQQFGI25O2XTQRK/

UPDATE 2026-10-27

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2026:89111

IBM provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.ibm.com/support/pages/node/7294053

WIBU provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100193.pdf

UPDATE 2026-10-30

Oracle Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
http://linux.oracle.com/errata/ELSA-2026-88693.html

Information

PHP 20 Oct 2026 Upcoming Critical PHP Security Release dated 2026-10-20
https://www.php.net/archive/2026.php#2026-10-20-1

CERT EU dated 2026-10-20
https://cert.europa.eu/publications/security-advisories/2026-018/

UPDATE 2026-10-22

Arch Linux Security Advisory ASA-202610-1 dated 2026-10-21
https://security.archlinux.org/ASA-202610-1

CheckMK Werk 19262 dated 2026-10-21
https://checkmk.com/werk/19262

Google Cloud Platform Security Bulletin GCP-2026-070 dated 2026-10-21
https://docs.cloud.google.com/support/bulletins#gcp-2026-070

cPanel & WHM Documentation dated 2026-10-21
https://docs.cpanel.net/changelogs/110-change-log/

cPanel & WHM Documentation dated 2026-10-21
https://docs.cpanel.net/changelogs/134-change-log/

cPanel & WHM Documentation dated 2026-10-21
https://docs.cpanel.net/changelogs/136-change-log/

cPanel & WHM Documentation dated 2026-10-21
https://docs.cpanel.net/changelogs/138-change-log/

Rocky Linux Security Advisory RLSA-2026:87070 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87070

Rocky Linux Security Advisory RLSA-2026:87071 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87071

Rocky Linux Security Advisory RLSA-2026:87072 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87072

Rocky Linux Security Advisory RLSA-2026:87079 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87079

Rocky Linux Security Advisory RLSA-2026:87151 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87151

Oracle Linux Security Advisory ELSA-2026-87070 dated 2026-10-22
https://linux.oracle.com/errata/ELSA-2026-87070.html

Oracle Linux Security Advisory ELSA-2026-87071 dated 2026-10-22
https://linux.oracle.com/errata/ELSA-2026-87071.html

SUSE Security Update SUSE-SU-2026:4844-1 dated 2026-10-21
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030008.html

SUSE Security Update SUSE-SU-2026:4843-1 dated 2026-10-21
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030009.html

Oracle Linux Security Advisory ELSA-2026-87151 dated 2026-10-22
https://linux.oracle.com/errata/ELSA-2026-87151.html

Debian Security Advisory DLA-4848 dated 2026-10-21
https://lists.debian.org/debian-lts-announce/2026/10/msg00042.html

Matomo Changelog dated 2026-10-22
https://matomo.org/changelog/matomo-5-14-2/

F5 Security Advisory K000163821 dated 2026-10-21
https://my.f5.com/manage/s/article/K000163821

Ubuntu Security Notice USN-8948-1 dated 2026-10-21
https://ubuntu.com/security/notices/USN-8948-1

Ubuntu Security Notice USN-8948-2 dated 2026-10-21
https://ubuntu.com/security/notices/USN-8948-2

Debian Security Advisory DSA-6574 dated 2026-10-21
https://security-tracker.debian.org/tracker/DSA-6574-1

Arch Linux Security Advisory ASA-202610-2 dated 2026-10-21
https://security.archlinux.org/ASA-202610-2

Red Hat Security Advisory RHSA-2026:87070 dated 2026-10-22
https://access.redhat.com/errata/RHSA-2026:87070

Red Hat Security Advisory RHSA-2026:87071 dated 2026-10-22
https://access.redhat.com/errata/RHSA-2026:87071

Red Hat Security Advisory RHSA-2026:87072 dated 2026-10-21
https://access.redhat.com/errata/RHSA-2026:87072

Red Hat Security Advisory RHSA-2026:87073 dated 2026-10-22
https://access.redhat.com/errata/RHSA-2026:87073

Red Hat Security Advisory RHSA-2026:87079 dated 2026-10-21
https://access.redhat.com/errata/RHSA-2026:87079

Red Hat Security Advisory RHSA-2026:87080 dated 2026-10-21
https://access.redhat.com/errata/RHSA-2026:87080

Red Hat Security Advisory RHSA-2026:87151 dated 2026-10-21
https://access.redhat.com/errata/RHSA-2026:87151

Amazon Linux Security Advisory ALAS2PHP8.2-2026-015 dated 2026-10-22
https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html

Fedora Security Advisory FEDORA-2026-A9354B8A1E dated 2026-10-21
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9354b8a1e

Fedora Security Advisory FEDORA-2026-A9EBA4BBC3 dated 2026-10-21
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9eba4bbc3

Fedora Security Advisory FEDORA-2026-D5F8446449 dated 2026-10-21
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449

Gentoo Linux Security Advisory GLSA-202610-02 dated 2026-10-21
https://bugs.gentoo.org/984631

PHP Security Advisory dated 2026-10-21
https://www.php.net/archive/2026.php#2026-10-21-5

cPanel Advisory dated 2026-10-22
https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619

Red Hat Security Advisory RHSA-2026:87414 dated 2026-10-22
https://access.redhat.com/errata/RHSA-2026:87414

Oracle Linux Security Advisory ELSA-2026-87080 dated 2026-10-22
https://linux.oracle.com/errata/ELSA-2026-87080.html

UPDATE 2026-10-23

Rocky Linux Security Advisory RLSA-2026:87073 dated 2026-10-22
https://errata.build.resf.org/RLSA-2026:87073

Red Hat Security Advisory RHSA-2026:88533 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88533

Red Hat Security Advisory RHSA-2026:88532 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88532

IBM Security Bulletin 7293670 dated 2026-10-23
https://www.ibm.com/support/pages/node/7293670

Oracle Linux Security Advisory ELSA-2026-87073 dated 2026-10-22
http://linux.oracle.com/errata/ELSA-2026-87073.html

Oracle Linux Security Advisory ELSA-2026-87079 dated 2026-10-22
http://linux.oracle.com/errata/ELSA-2026-87079.html

SUSE Security Update SUSE-SU-2026:4853-1 dated 2026-10-22
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030018.html

SUSE Security Update SUSE-SU-2026:4852-1 dated 2026-10-22
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030019.html

SUSE Security Update SUSE-SU-2026:24271-1 dated 2026-10-22
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030025.html

SUSE Security Update SUSE-SU-2026:4870-1 dated 2026-10-22
https://lists.suse.com/pipermail/sle-security-updates/2026-October/030034.html

Red Hat Security Advisory RHSA-2026:88565 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88565

Red Hat Security Advisory RHSA-2026:88561 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88561

UPDATE 2026-10-26

Red Hat Security Advisory RHSA-2026:88835 dated 2026-10-24
https://access.redhat.com/errata/RHSA-2026:88835

Google Cloud Platform Security Bulletin GCP-2026-072 dated 2026-10-24
https://docs.cloud.google.com/support/bulletins#gcp-2026-072

Red Hat Security Advisory RHSA-2026:88659 dated 2026-10-24
https://access.redhat.com/errata/RHSA-2026:88659

Red Hat Security Advisory RHSA-2026:88659 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88659

Red Hat Security Advisory RHSA-2026:88693 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88693

Red Hat Security Advisory RHSA-2026:88720 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88720

Red Hat Security Advisory RHSA-2026:88725 dated 2026-10-23
https://access.redhat.com/errata/RHSA-2026:88725

Red Hat Security Advisory RHSA-2026:88834 dated 2026-10-24
https://access.redhat.com/errata/RHSA-2026:88834

openSUSE Security Update OPENSUSE-SU-2026:22151-1 dated 2026-10-23
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YZRCJS4A4MBLLEJL6SQQFGI25O2XTQRK/

UPDATE 2026-10-27

Red Hat Security Advisory RHSA-2026:89111 dated 2026-10-26
https://access.redhat.com/errata/RHSA-2026:89111

IBM Security Bulletin 7294053 dated 2026-10-26
https://www.ibm.com/support/pages/node/7294053

WIBU Product Security Advisory dated 2026-10-27
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100193.pdf

UPDATE 2026-10-30

Oracle Linux Security Advisory ELSA-2026-88693 dated 2026-10-30
http://linux.oracle.com/errata/ELSA-2026-88693.html

References

AMAZONLINUX:ALAS2PHP8.2-2026-015
ARCHLINUX:ASA-202610-1
ARCHLINUX:ASA-202610-2
CHECKMK:19262
CVE:CVE-2026-109618
CVE:CVE-2026-109619
DEBIAN:DLA-4848
DEBIAN:DSA-6574
EUVD:EUVD-2026-107260
EUVD:EUVD-2026-107265
F5:K000163821
FEDORA:FEDORA-2026-A9354B8A1E
FEDORA:FEDORA-2026-A9EBA4BBC3
FEDORA:FEDORA-2026-D5F8446449
GENTOO:GLSA-202610-02
GOOGLECLOUD:GCP-2026-070
GOOGLECLOUD:GCP-2026-072
IBM:7293670
IBM:7294053
OPENSUSE:OPENSUSE-SU-2026:22151-1
ORACLELINUX:ELSA-2026-87070
ORACLELINUX:ELSA-2026-87071
ORACLELINUX:ELSA-2026-87073
ORACLELINUX:ELSA-2026-87079
ORACLELINUX:ELSA-2026-87080
ORACLELINUX:ELSA-2026-87151
ORACLELINUX:ELSA-2026-88693
REDHAT:RHSA-2026:87070
REDHAT:RHSA-2026:87071
REDHAT:RHSA-2026:87072
REDHAT:RHSA-2026:87073
REDHAT:RHSA-2026:87079
REDHAT:RHSA-2026:87080
REDHAT:RHSA-2026:87151
REDHAT:RHSA-2026:87414
REDHAT:RHSA-2026:88532
REDHAT:RHSA-2026:88533
REDHAT:RHSA-2026:88561
REDHAT:RHSA-2026:88565
REDHAT:RHSA-2026:88659
REDHAT:RHSA-2026:88693
REDHAT:RHSA-2026:88720
REDHAT:RHSA-2026:88725
REDHAT:RHSA-2026:88834
REDHAT:RHSA-2026:88835
REDHAT:RHSA-2026:89111
ROCKYLINUX:RLSA-2026:87070
ROCKYLINUX:RLSA-2026:87071
ROCKYLINUX:RLSA-2026:87072
ROCKYLINUX:RLSA-2026:87073
ROCKYLINUX:RLSA-2026:87079
ROCKYLINUX:RLSA-2026:87151
SUSE:SUSE-SU-2026:24271-1
SUSE:SUSE-SU-2026:4843-1
SUSE:SUSE-SU-2026:4844-1
SUSE:SUSE-SU-2026:4852-1
SUSE:SUSE-SU-2026:4853-1
SUSE:SUSE-SU-2026:4870-1
UBUNTU:USN-8948-1
UBUNTU:USN-8948-2
VULNAME:PHP2SHELL

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.