Both advisories describe unauthenticated remote code execution as the PHP worker’s operating-system user. That is the account Apache, PHP-FPM, or the other SAPI uses. It is not automatically root. It is still enough to read the application’s files, change content the worker can write, and start further activity from that account.
Attack complexity in the CVSS v4.0 vector is High, and attack requirements are Present. PHP also says additional workers and unrelated traffic can increase the number of attempts without removing the condition. Reliability depends on the build, extensions, frontend, and allocator. Those qualifiers do not make an internet-facing runtime optional to patch. CISA asked organizations to patch immediately and to prioritize internet-facing systems.
SAPI differences you can defend
mod_php is the highest-risk case PHP describes, because request shutdown still runs when startup fails, and the demonstrated exploit does not need application code.
FPM is safer against that specific startup failure because the child exits. It is still in scope. Session upload progress provided a validated FPM path for CVE-2026-109619 when the application has a suitable failing operation. Red Hat’s CVE page, which scores the issue for Red Hat products at CVSS v3 8.1 rather than PHP’s CVSS v4.0 9.2, also says standard RHEL deployments use PHP-FPM and that remote code execution there is harder and often depends on application behavior. Use PHP’s CVSS v4.0 9.2 as the upstream severity, and read Red Hat’s score as a product-specific rating.
Exposure is the web SAPI
A server with a patched CLI and an old php-fpm pool is still exposed. So is a container whose manifest was updated while an old pod remains ready. Inventory the process that accepts the public request before you close the incident.
Questions
Was exploitation in the wild confirmed on disclosure day?
CISA said it had not observed exploitation as of its 21 October 2026 alert. The Canadian Cyber Centre said it had not identified active exploitation at that time and had seen open-source reporting of a proof of concept. This site does not link to exploit code.