Latest information about PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619

Summary

On October 21, 2026, the PHP Project released details and security updates regarding two critical vulnerabilities. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution (RCE) on web servers running PHP applications under certain conditions. In general, PHP installations that process web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

This vulnerability is relevant to edoc because several of its components use PHP. We therefore classify our products as affected.

The Monthly Release 2026/09.1 and the Quarterly Hotfix 2026/Q3.1, which include the necessary fixes, are now available.

Additional information online:

• https://www.php.net/archive/2026.php#2026-10-20-1

• RCE via OOM corruption · Advisory · php/php-src

• RCE via stale global state · Advisory · php/php-src

• BSI - Federal Office for Information Security - Version 1.0: PHP - Critical Vulnerabilities Threaten Web Applications Worldwide (currently available only in German)

Updates to this article

Current situation

The published information confirms two critical PHP vulnerabilities that allow remote code execution:

• CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: A flaw in the out-of-memory handling may cause PHP to continue processing incompletely initialized internal request data during cleanup. Among other things, specially crafted multipart requests can cause memory usage to increase in a controlled manner.

• CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: Internal global state from a previous request may persist in a worker after memory is freed and be reused by a subsequent request. This can lead to use-after-free, memory leaks, and remote code execution.

The fixed versions listed by the PHP Project are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Updating to a patched version of PHP is the only complete solution. Mitigation measures can reduce the risk but are not a substitute for the update.

Impact on edoc products

Several applications of the edoc business process platform and edoc agent components (edoc platform) use PHP technologies. Since the vulnerabilities affect PHP installations that process web requests, we assume that our system is affected and have updated the affected components.

Recommended precautions

For on-premises customers, the security updates are available in Monthly Release 2026/09.1 and Quarterly hotfix 2026/Q3.1.

Until you install the update available for your release channel, we continue to recommend that you limit access to the edoc platform web server as much as possible. In particular, access to HTTPS/Port 443 should be restricted to only those networks, user groups, or upstream security systems that require it.

This measure reduces the attack surface for unauthenticated attacks from the Internet, but does not replace the installation of security updates. Please evaluate its implementation based on your infrastructure and business requirements.

Measures completed by edoc

The fix is included in the latest releases of the following release channels:

• Monthly Channel

• Quarterly Channel

We strongly recommend that you install the update available for your release channel as soon as possible. By using the latest versions, you can apply necessary security updates more quickly and thereby minimize potential maintenance and downtime.

The fix was released with the Monthly Release 2026/09.1 and the Quarterly hotfix 2026/Q3.1.

For on-premises customers, separate information was provided regarding the options for updating.

Deployment of security updates

The updated Release Monthly 2026/09.1 and the Quarterly Hotfix 2026/Q3.1 are available.

• Customer systems with automatic updates enabled will receive the update automatically according to their update configuration.

• For customer systems without automatic updates, the provided updates must be installed manually.

Note on the edoc agent

edoc agent runs on Ubuntu systems. The PHP version used there is provided via the operating system’s package manager. On systems with security updates enabled—for example, via unattended-upgrades—the corresponding PHP security updates are typically installed automatically by the operating system as soon as they become available. The PHP installation on the edoc platform itself is not affected, as the platform does not provide a web server but only offers CLI access.

Please update the server with edoc platform (edoc agent) as soon as possible. This will ensure that the latest, patched version of phpMyAdmin is downloaded during the next synchronization process (Sync), since phpMyAdmin was also affected by the vulnerability.

Current status

• edoc365 customers have been automatically updated. The systems are once again fully operational.

• Until the update available for your release channel is installed, we continue to recommend that on-premises customers limit access to the edoc platform web server (port 443) as much as possible.

• The Monthly Release 2026/09.1 and the Quarterly hotfix 2026/Q3.1, which include the necessary fixes, are now available.

• Details and security updates regarding two critical PHP vulnerabilities have been released.

• PHP installations that process web requests are affected. edoc uses PHP and therefore classifies the affected components as affected.

• Under certain conditions, these vulnerabilities could allow unauthenticated remote code execution.

Last updated: October 23, 2026