The recent critical PHP vulnerabilities have once again demonstrated how quickly organisations can move from routine operations to urgent remediation activities. While emergency security updates are now available, these vulnerabilities serve as a reminder that effective cybersecurity requires more than simply applying patches.
Security leaders must first answer a fundamental question: Do we know where we're exposed?
Understanding the Vulnerabilities
The PHP security team recently disclosed two critical remote code execution (RCE) vulnerabilities:
- RCE via OOM corruption, CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- RCE via stale global state, CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Source: https://www.php.net/archive/2026.php#2026-10-21-5
Emergency patches have been released for supported PHP versions, including 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports also available for older versions.
For many organisations, remediation is relatively straightforward: identify affected systems and apply the appropriate updates. However, the challenge often lies in both discovering every instance of PHP across increasingly complex environments and addressing legacy systems running unsupported versions that require upgrades rather than routine patching. In many cases, application dependencies and accumulated technical debt can make remediation significantly more complex.
A Critical Vulnerability Is More Than a Patching Exercise
When vulnerabilities like these emerge, security teams should be asking:
- Do we know every affected asset in our environment?
- Can we accurately identify which systems are internet-facing?
- Are we able to prioritise remediation based on business risk?
- Can we verify and demonstrate that remediation has been completed everywhere it is required?
- Do we have compensating controls in place while patches are being tested and deployed?
Patching is an action. Visibility is a capability.
Without a clear understanding of their environment, organisations risk leaving vulnerable assets exposed long after official updates become available.
Red Piranha's Response
From the moment these vulnerabilities were disclosed, Red Piranha teams began assessing potential impacts across internal systems and the Crystal Eye ecosystem.
Where exposure was identified, active remediation and patch validation activities commenced immediately. Our teams continue to monitor developments from the PHP security community and evaluate any additional recommendations as they become available.
For organisations managing externally hosted websites, applications or services through third-party providers, we strongly recommend seeking assurance that these vulnerabilities have been assessed and remediated appropriately.
Red Piranha Customer Advisory
Crystal Eye uses PHP for some components of its web-based interface. Crystal Eye versions 5.5 and later have been tested against CVE-2026-109618 and CVE-2026-109619. Based on our testing, the currently identified proofs of concept were not able to successfully exploit these versions.
Based on our current assessment, we have identified no exploitable attack pathway for these vulnerabilities within Crystal Eye.
Crystal Eye's automated rolling software updates and patching reduce the burden of manual remediation. While no exploitable attack pathway has been identified within the Crystal Eye, for complete assurance we are preparing a hotfix for affected libraries with the remediation to be delivered through our automated update system.
The hotfix will be released at the earliest opportunity following completion of our testing and validation processes.
Orchestrate is protected behind our Web Application Firewall, which provides an additional layer of protection while remediation work is completed. We are also actively preparing and validating a permanent patch for Orchestrate.
We will provide a further update once the hotfix and patch have been validated and are ready for release or deployment, including any actions customers may need to take.
Further updates will be provided as testing and release activities progress.
Strengthening Exposure Management
Critical vulnerabilities will continue to emerge. The difference between a security alert and a security incident often comes down to visibility, prioritisation and response maturity.
Red Piranha helps organisations identify exposure, prioritise risk, implement mitigations, and validate remediation outcomes across their environments. By combining proactive security monitoring, threat detection and exposure management, organisations can respond with confidence when the next critical vulnerability is disclosed.
If your organisation needs assistance assessing exposure or implementing mitigation measures related to these PHP vulnerabilities, Red Piranha is here to help. Contact our team today.