Recent security disclosures have revealed two critical, unauthenticated Remote Code Execution (RCE) vulnerabilities in the core PHP interpreter: CVE-2026-109618 and CVE-2026-109619. These flaws present severe risks to internet-facing web servers globally, allowing remote attackers to execute arbitrary code without authentication.

This guide provides a comprehensive technical breakdown of these vulnerabilities, an assessment of exposure vectors, and a rigorous, step-by-step end-to-end remediation strategy for system administrators and engineering teams.

1. Vulnerability Mechanics & Technical Breakdown

Unlike application-level vulnerabilities (such as SQL injection or insecure deserialisation in third-party CMS plugins), these flaws reside directly within the core PHP runtime execution engine.

* CVE-2026-109618: Out-of-Memory Corruption

*

Mechanism: When a PHP script triggers an out-of-memory (OOM) condition or hits allocated memory limits during execution, internal request structures are left in a…