What PHP's CVSS 9.2 rating means for shared hosting after CVE-2026-109618
On a dedicated server, remote code execution in the web server account is serious. On a shared host running hundreds of tenants from one interpreter build, it changes what one customer can reach. The PHP advisory published on 21 October 2026 is worth reading with that deployment model in mind.
The advisory in one paragraph
CVE-2026-109618 and CVE-2026-109619 are critical PHP core vulnerabilities, both rated 9.2 under CVSS v4.0, both allowing unauthenticated remote code execution. Fixes shipped on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT.RS relayed the release with recommendations for Serbian operators, and CSIRT.CY published the technical detail.
The trigger is memory exhaustion, not a payload format
The engine enforces memory_limit with longjmp(). When a request allocates past the ceiling, PHP aborts to a recovery point rather than unwinding normally. If that abort lands while the request's internal structures are still being assembled, the cleanup code that follows sees fields that were never initialised. The advisory describes it treating invalid data as valid and freeing memory the request never allocated. Earlier allocations may still hold attacker-influenced content at that address.
Upload parsing is the example the advisory provides, because a multipart request leaves many structures half-built while the body streams in.
Why shared hosting concentrates the risk
One interpreter serves many accounts. Where the hosting platform runs a single PHP version per pool, an unpatched build leaves every site on that pool in the same position, and the code execution obtained is inside a process that may hold other tenants' configuration paths in memory.
Restrictions that normally keep tenants apart, such as open_basedir and disabled functions, limit what a compromised account can read. They do not turn a shared interpreter into separate interpreters, and a hosting provider cannot patch one customer without updating the build everyone shares.
The practical question for a customer is not whether the platform is patched today but how quickly it normally applies interpreter updates, and whether the answer can be verified. Querying the PHP version through phpinfo() or a version endpoint is the only direct check available from outside.
Impact beyond the site
Code execution in the web user's context exposes configuration files, database credentials and session secrets. In hosting environments where outbound traffic is not filtered, the compromised process also provides a foothold for reaching the provider's internal network.
Affected versions
PHP 8.5 below 8.5.12, 8.4 below 8.4.27, 8.3 below 8.3.36, and 8.2 below 8.2.35. PHP 8.1 and earlier are end-of-life and unpatched through ordinary channels, although the PHP security team published minimal retrospective fixes for 7.4, 8.0 and 8.1 aimed at source builders.
Exposure context
A ZoomEye query on app="PHP" matched 94,382,282 assets at the recorded time. Because PHP seldom advertises a precise patch level, that count identifies the population that needs verification rather than the number of vulnerable systems. Hosting and managed platform addresses are heavily represented in that population.
Mitigation for customers and providers
Providers should refresh interpreter packages, restart the pools using the old build, and publish the patched version number so customers can check it themselves. Where an immediate update is impossible, restricting the request body size accepted by the front-end proxy removes much of the reachable abort path.
Customers who cannot confirm the platform version should reduce what a compromised application would expose: rotate database and API credentials held in application configuration, keep secrets outside the web root, and monitor for unexpected outbound connections from the hosting account.
