PHP ships emergency patches for two critical RCE flaws

As of Oct. 22, the PHP project has shipped emergency fixes for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. Security vendors report exploitation attempts, but U.S. and Canadian agencies say they have not confirmed active compromise as of their alerts.

The flaws

CVE-2026-109618 is an out-of-memory corruption bug that leaves request data uninitialized; CVE-2026-109619 is a use-after-free that lets a later request use stale global state. PHP said the fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project said every PHP deployment that handles web requests is vulnerable, including mod_php and PHP-FPM, and called updating "the only safe choice."

PHP said mod_php carries the highest risk, because an attacker can send a request that reaches the bug before any application code executes. For CVE-2026-109619, PHP validated remote code execution against both mod_php and FPM. The researchers' disclosure site said they demonstrated pre-authentication RCE on WordPress, Drupal and Joomla.

Timeline

On Oct. 20, PHP published an advance notice scheduling the release for Oct. 21 at 14:00 UTC. It said it could move faster if details leaked or exploitation appeared. Later that day, a Hacker News post named the CVE IDs and claimed CVSS 10.0 scores. watchTowr told BleepingComputer the bugs were real and affected PHP 5, 6, 7 and 8.

Cloudflare deployed WAF rules for all customers at 03:02 UTC on Oct. 21, before the official release. PHP published its GitHub advisories at 13:34 UTC, then the CVE records, and announced the fixed versions. After the release, proof-of-concept code circulated, and CERT-EU said initial PoCs had begun to circulate.

Palo Alto Networks' Unit42 said its Cortex Xpanse telemetry identified more than 22.6 million exposed instances potentially vulnerable to the flaws. CyberScoop reported a Shodan search counted about 1.9 million exposed hosts, with most running unsupported PHP branches.

Exploitation status

As of Oct. 22, security companies report different pictures. watchTowr said it observed active exploitation attempts through its honeypot network, but SecurityWeek reported the firm had not seen successful attempts. Amazon said its MadPot network recorded an attempt dated Oct. 17, four days before disclosure, and that PHP2Shell is now broadly exploited. Hadrian said it saw exploitation at scale. Patchstack logged incidents from hosting partners but later said its telemetry showed only probing.

CISA's alert on Oct. 21 said it "has not observed exploitation of these vulnerabilities as of the time of publication." The Canadian Centre for Cyber Security said there was no active exploitation identified at that time. Huntress told CyberScoop it found no post-exploitation behavior on customer systems, and Fastly's chief product officer said attackers were actively probing.

AI's role

The flaws were found with AI assistance. Calif found the first bug in August with OpenAI's GPT-5.6 Sol during an audit funded by OpenAI's Patch the Planet initiative. Wiz said it independently found the flaws using Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol. PHP's advisory lists researchers from Calif, Wiz and OpenAI as the finders.

OpenAI called the situation a "Defender's Window" and said it considers the flaws "one of the most impactful security issues in recent memory." Wiz researchers said AI lowers the work required to build and adjust complex exploits, changing the economics of discovery.

What to do

Patch immediately. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install a patched package from your distribution. After updating, restart the web server, PHP-FPM, and any PHP processes that stay running. CISA said organizations should apply the patch, prioritizing internet-facing systems.

Inventory PHP everywhere, including bundled runtimes and appliances. CISA advised that PHP frequently ships inside other software, so it may not be easy to see where it is installed. For PHP 8.1 and older, PHP provided source backports for 7.4, 8.0 and 8.1, but the project recommends upgrading to a supported branch or using an LTS vendor.

If you cannot patch right away, PHP's temporary measures reduce exposure but are not complete. Cloudflare said WAF protections are defense-in-depth and customers should still patch. Amazon advises starting compromise investigations from Oct. 17.