// AI threat desk · 22 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalRCECVSS 10.0 / 9.2

PHP 8.x updates fix two critical RCE flaws after disclosure leak

PHP released updates across its 8.x line on Oct 21, 2026, fixing two remote code execution flaws; Simon Willison said exploits circulated after a disclosure leak.

· 2 min read
AI-generated image of a security analyst reviewing blurred server logs and software update screens in a dark operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • PHP updates across the entire PHP 8.x line address two remote code execution holes.
  • Simon Willison said exploits had been circulating since the previous night because of a leak in the coordinated disclosure process.
  • PHP said the two CVE IDs began circulating on 20 October 2026 at around 15:00 UTC, with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2).

PHP released updates across its entire PHP 8.x line on Oct 21, 2026, fixing two critical remote code execution vulnerabilities.

The vulnerabilities allow unauthenticated attackers to execute code on servers running PHP under the right conditions. Simon Willison said exploits had been circulating since the previous night because of a leak in the coordinated disclosure process.

PHP runs a large share of the web, including government services, online stores, banks, media sites and business software. Wiz Research said PHP powers 70% of websites worldwide.

On this page

The flaws involve out-of-memory corruption and stale global state

CVE-2026-109618 is remote code execution caused by out-of-memory corruption. CVE-2026-109619 is remote code execution caused by stale global state.

Wiz Research said the vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. It demonstrated a combined php2shell exploit script executing code remotely without authentication against WordPress, Drupal and Joomla deployments.

A leaked disclosure accelerated proof-of-concept circulation

The PHP Foundation said the video contributed to accelerated development of proof-of-concept exploits, which increased circulation on Oct 21. Chainguard published built images containing the fix at 07:41 UTC on Oct 21, more than six hours before the coordinated release.

Wiz reported the vulnerabilities after confirming unauthenticated RCE

Wiz Research discovered the first PHP vulnerability on Aug 19, 2026, using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. It confirmed unauthenticated remote code execution against Drupal on Aug 20 and WordPress on Aug 21, then reported the vulnerabilities to the PHP security team on Aug 24.

PHP acknowledged Wiz’s reports and began developing a coordinated fix on Sep 21, 2026. Help Net Security reported that the two vulnerabilities were each rated 9.2 Critical under CVSS version 4.0.

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as part of the updates. The PHP Foundation said its security team monitored proof-of-concept material after the leak but did not identify functional exploits at the time of release and public disclosure.

FAQ

What happened in PHP 8.x?

PHP released updates across its entire PHP 8.x line to address two remote code execution vulnerabilities.

Which PHP versions are affected?

Wiz Research said every PHP version released in the previous decade is affected by at least one vulnerability, going back to PHP 5.4.

Were the PHP vulnerabilities exploited?

Simon Willison said exploits had been circulating since the previous night because of a leak in the coordinated disclosure process. The PHP Foundation said it did not identify functional exploits at the time of release and public disclosure.

What do CVE-2026-109618 and CVE-2026-109619 do?

CVE-2026-109618 is remote code execution caused by out-of-memory corruption, while CVE-2026-109619 is remote code execution caused by stale global state.

Which PHP updates fix the flaws?

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz Research said applying the PHP security update remains the only complete remediation.

Sources

  1. Today's PHP Security Release, and How We're Strengthening PHP Security, PHPPrimary
  2. Today, PHP FoundationPrimary
  3. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog, Wiz ResearchPrimary
  4. A critical PHP security release is coming today, so get ready to update!, Help Net Security
How we checked this story
ClaimSourceStatus
PHP updates across the entire PHP 8.x line address two remote code execution holes.PHPAttributed
Simon Willison said exploits had been circulating since the previous night because of a leak in the coordinated disclosure process.Simon WillisonAttributed
PHP said the actual CVSS score was 9.2, rather than the circulated score of 10.0.PHPAttributed
Help Net Security reported that the two vulnerabilities were each rated 9.2 Critical under CVSS version 4.0.Help Net SecurityAttributed
The PHP Foundation said the two vulnerabilities allow unauthenticated attackers to execute code under the right conditions.PHP FoundationConfirmed
The PHP project published its pre-announcement at 19:30 UTC after the CVE leak.PHP FoundationConfirmed
Chainguard published built images containing the fix at 07:41 UTC on 21 October, more than six hours before coordinated release.PHP FoundationConfirmed
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.PHP FoundationConfirmed
The first vulnerability was discovered by Wiz Research on 19 August 2026 using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.Wiz ResearchConfirmed
Wiz confirmed unauthenticated remote code execution against Drupal on 20 August 2026.Wiz ResearchConfirmed
Wiz confirmed unauthenticated remote code execution against WordPress on 21 August 2026.Wiz ResearchConfirmed
Wiz Research reported the vulnerabilities to the PHP security team on 24 August 2026.Wiz ResearchConfirmed
PHP acknowledged Wiz’s reports and began developing a coordinated fix on 21 September 2026.Wiz ResearchAttributed
Wiz Research said the vulnerabilities affect PHP versions released during the previous decade, going back to version 5.4.Wiz ResearchAttributed
Wiz said the vulnerabilities can allow unauthenticated attackers to execute code or read sensitive process memory.Wiz ResearchAttributed
Wiz demonstrated its combined php2shell exploit script executing code remotely without authentication against WordPress, Drupal, and Joomla.Wiz ResearchAttributed
Wiz said applying the PHP security update remains the only complete remediation.Wiz ResearchAttributed
CVE-2026-109618 is remote code execution caused by out-of-memory corruption.PHP FoundationConfirmed
CVE-2026-109619 is remote code execution caused by stale global state.PHP FoundationConfirmed
The PHP Foundation said it did not identify functional exploits at the time of release and public disclosure.PHP FoundationConfirmed
The PHP Foundation said PHP runs a large share of the web, including government services, online stores, banks, media sites, and business software.PHP FoundationConfirmed
Wiz said PHP powers 70% of websites worldwide.Wiz ResearchAttributed
simonwillison.net published its report on Oct 21, 2026.simonwillison.netConfirmed
wiz.io published its report on Oct 21, 2026.wiz.ioConfirmed

Could not verify

  • Whether the circulating exploits were used against real-world targets is not established.
  • How many PHP installations were affected or exploited is not established.
  • Whether the two vulnerabilities were exploited before public disclosure is not established.
  • Whether CVE-2026-109618 or CVE-2026-109619 was exploited independently is not established.
cvedata leak
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok