Connecting election experts, advancing security
Advisory insights from the Election Security Exchange

Alert/Advisory: Critical PHP Vulnerabilities Announced

Published: October 21, 2026

Alert

TLP:CLEAR

Jump to Advisory

The PHP Security Team announced that a critical patch will be released on Wednesday, October 21, 2026. The two vulnerabilities identified reportedly allow an attacker to take control of an affected web server over the internet. These vulnerabilities can be exploited until systems are patched.

Election offices should contact the managers of their websites and online voter tools today and confirm they can apply a critical PHP security update when it is released on Wednesday, October 21, at 9:00 AM CT (10:00 AM ET / 14:00 UTC).

PHP is a widely used programming language that runs behind many websites, including election websites. Common website platforms, including WordPress and Drupal, are built on PHP.

Election office systems that may use PHP include:

  • Election office websites
  • Voter registration and voting location lookup tools
  • Sample ballot and ballot tracking tools
  • Election results reporting pages
  • Online forms, such as absentee ballot requests or election worker applications

This ALERT is solely to inform you of the critical vulnerability that may impact your election related websites. The Election Security Exchange will send out additional ADVISORY information, including information about the patches, once they are released.

Sources

Advisory

  • This ADVISORY is an update to the ALERT above and includes information on how to mitigate the risk. PHP has released a patch for the vulnerabilities, available at https://www.php.net/archive/2026.php.
  • Immediate Action: Contact the managers of your websites and online voter tools today and confirm that they are implementing the critical PHP security updates released today, Wednesday, October 21. The two vulnerabilities can allow an attacker to take control of an affected web server over the internet without logging in. Attackers can exploit those vulnerabilities until systems are patched.

What PHP Is and What May Be Affected

PHP is a widely used programming language that runs behind many websites, including election websites. Common website platforms, including WordPress and Drupal, are built on PHP.

Election office systems that may use PHP include:

  • Election office websites
  • Voter registration status and polling place lookup tools
  • Sample ballot and ballot tracking tools
  • Election night results pages
  • Online forms, such as absentee ballot requests or poll worker applications

These systems may be managed by office staff, county IT, a vendor, or a hosting provider. Even when someone else runs a system, your office will want to confirm that it gets patched. If you do not know whether a system uses PHP, ask whoever manages it. With the election less than two weeks away, voters rely heavily on these online tools so keeping them secure and available is critical.

What We Know

  • PHP rates both vulnerabilities as CRITICAL (CVSS v4.0 score of 9.2 out of 10).
  • The two vulnerabilities are:
    • Remote Code Execution (RCE) via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
    • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
  • PHP released updates this morning for PHP versions 8.2 and greater.
  • PHP confirms both flaws allow remote code execution (an attacker running their own commands on your server) without a login.
  • No attacks have been reported in the wild as of publication; however, attackers will quickly seek to exploit these reported vulnerabilities.

Suggested Actions

Today

  1. Contact the IT professional who manages your website to inform them of the critical vulnerability; share this ADVISORY with them.
  2. Ask them to identify systems that use PHP and the versions running on the election websites and tools.
    1. PHP has identified versions 8.1 and older as no longer receiving updates from the PHP project. If your election website runs on one of these older versions, work with your IT and website providers to apply partial code fixes, move to a supported version, or consider an alternative solution, such as temporary rules that block attacks on these flaws, to mitigate the risk.
  3. Agree on timing for implementing the patch. Target public-facing systems as soon as possible.
  4. Apply the updates, starting with public-facing systems. PHP announced versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as being the patched versions. You can download the patched versions here. Starting with public-facing systems.
  5. Identify systems on unsupported PHP versions (7.x and earlier), which may not receive a fix, identify the alternative mitigations provided by PHP, and work with your IT and website providers on an alternative solution to mitigate the risk.
  6. Obtain written confirmation from vendors and hosting providers that updates are complete and which PHP version each system now runs.
  7. Monitor websites for unauthorized changes.

If you cannot update immediately

PHP says that only an update is a complete solution, but provides the following additional measures to reduce exposure to specific attack paths.

For CVE-2026-109618: Remote Code Execution (RCE) via out-of-memory (OOM) corruption:

  • Set memory_limit=-1, preferably in a way applications can’t override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory, or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.
  • Set a low post_max_size. For applications that don’t require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
  • Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause vulnerable allocation failure.

For CVE-2026-109619: RCE via stale global state

  • Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool, or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.
  • On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only.
  • Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors, or @ does not help.
  • Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup.

Reporting

Report suspected compromise to your state election office, state fusion center, the EI-ISAC ([email protected]), and CISA ([email protected] or 1-844-SAY-CISA).

Sources