Status: Patched & Protected
Severity: Critical
The PHP development team has released critical security updates addressing two unauthenticated Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities affect various PHP configurations (including PHP-FPM, Apache mod_php, and LiteSpeed) and carry significant risk if left unmitigated.
We want to reassure all Uptime clients that your infrastructure is secure:
Immediate Patch Deployment: Our engineering and security teams have successfully applied the latest PHP security patches across all supported environments (PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35).
Active Server Security & Defense: In addition to core runtime updates, our on-server security tooling, web application firewall (WAF) rules, and monitoring layers are actively inspecting inbound requests to detect, intercept, and block any potential exploit vectors targeting these or related flaws before they can interact with your application code.
No Action Required: No client-side or application code changes are required on your end. Your services are fully up to date and continuously guarded.
CVE-2026-109618 (RCE via Out-Of-Memory Corruption): Involves flaws in how internal request data is handled and cleaned up during memory exhaustion events.
CVE-2026-109619 (RCE via Stale Global State): Involves request-owned internal state surviving improperly across requests handled by the same worker.
By updating the underlying PHP runtime and enforcing robust runtime configurations, these exposure paths have been entirely neutralized on Uptime-managed servers.
