// AI threat desk · 25 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 10.0 / 9.2

PHP shipped emergency updates for flaws that could execute code

PHP shipped emergency updates for two critical vulnerabilities affecting web-serving installations, after Cloudflare reported attempted exploitation.

· 2 min read
AI-generated image of analysts monitoring blurred server security alerts in a security operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • PHP shipped emergency updates for two critical vulnerabilities.
  • Cloudflare reported attempted exploitation, while CISA had not observed successful exploitation when it published its alert.
  • Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

PHP shipped emergency updates for two critical vulnerabilities that can allow unauthenticated attackers to execute code on PHP servers under the right conditions.

The flaws affect all PHP installations serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Cloudflare reported seeing attempted exploitation, while CISA said it had not observed successful exploitation when it published its advisory.

PHP is used by 69.3% of websites whose server-side programming language was known in October 2026, according to W3Techs. The PHP Foundation said leaked CVE information included an incorrect CVSS score of 10.0, while the actual score was 9.2.

On this page

CERT-EU linked the flaws to memory corruption and stale global state

CERT-EU said one vulnerability stems from memory corruption during out-of-memory handling, while the other arises from stale global state.

Censys said the PHP project confirmed working attacks for each flaw on different server setups. Palo Alto Networks Unit 42 said its researchers had observed proof-of-concept exploit code for both vulnerabilities.

PHP exposure reached millions of hosts before the emergency updates

Censys identified 6,292,667 hosts and 115,000,393 web properties matching its PHP exposure queries on Wednesday. VirusTotal identified 5.1 million IP addresses running PHP, including 758,000 on end-of-life versions and 85,000 on the latest pre-patch releases.

The PHP Foundation said outside AI-company reviews first drew serious attention to the vulnerabilities in August. It said the history of one vulnerability dates back to 2024, when PHP underwent its first external security audit in several years.

The PHP Foundation moved the release as CVE IDs circulated

The PHP Foundation said the two CVE identifiers began circulating on online forums and social media on Oct 20 at about 15:00 UTC. It also moved the release from Oct 22 at 14:00 UTC to Oct 21 at 14:00 UTC.

The Record said companies and governments took hundreds of websites offline because of the two vulnerabilities. Palo Alto Networks also reported that at least one European government took its website offline as a precaution.

CISA said organizations unable to update immediately, or still using unsupported PHP 8.1 or earlier, should take PHP-based systems offline until they can patch or update.

CISA also said a web application firewall may provide some protection until systems are updated or patched, and urged defenders to monitor for PHP worker processes launching shells or downloading tools.

What to do now

  1. Immediately update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  2. Take PHP-based systems offline until they can be patched or updated if you cannot update immediately or use PHP 8.1 or earlier.
  3. Monitor for suspicious activity, including PHP worker processes launching shells or downloading tools.

FAQ

What happened to PHP?

PHP shipped emergency updates for two critical vulnerabilities that can allow unauthenticated attackers to execute code on PHP servers under the right conditions.

Were the PHP vulnerabilities exploited?

Cloudflare reported attempted exploitation. CISA said it had not observed successful exploitation when it published its alert.

Who is affected by the PHP flaws?

All PHP installations serving web requests are affected, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

What caused the two PHP vulnerabilities?

CERT-EU said one stems from memory corruption during out-of-memory handling, while the other arises from stale global state.

Sources

  1. Today, PHP FoundationPrimary
  2. Critical Vulnerabilities in PHP Require Immediate Patching | CISA, CISAPrimary
  3. Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal, VirusTotalPrimary
  4. PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024, The Record
  5. PHP rushes out emergency patches for two critical bugs AI found first, The Next Web
  6. Two Critical PHP Bugs Put 70% of the Web at Risk, NSA Urges Immediate Patch, Hoodline
How we checked this story
ClaimSourceStatus
The PHP Foundation said outside AI-company reviews first drew serious attention to the two vulnerabilities in August.PHP Foundation, via The RecordAttributed
The PHP Foundation said CVE-2026-109618’s history dates back to 2024, when PHP underwent its first external security audit in several years.PHP Foundation, via The RecordAttributed
The Record said companies and governments took hundreds of websites offline on Wednesday because of CVE-2026-109618 and CVE-2026-109619.The RecordAttributed
VirusTotal identified 5.1 million IP addresses running PHP, including 758,000 on end-of-life versions and 85,000 on the latest pre-patch releases.VirusTotal, via The RecordAttributed
PHP shipped emergency updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.PHP, via The Next WebAttributed
The vulnerabilities let an unauthenticated attacker execute code on PHP servers under the right conditions.PHP FoundationConfirmed
CISA said it had not observed successful exploitation in the wild when it published its alert.CISAConfirmed
CISA said the vulnerabilities affect all PHP installations serving web requests, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.CISAConfirmed
CISA said a web application firewall may provide some protection until systems are updated or patched.CISAConfirmed
The PHP Foundation said the two CVE IDs began circulating on forums and social media on 20 October at about 15:00 UTC.PHP FoundationConfirmed
The PHP Foundation said the leaked CVE information included an incorrect CVSS score of 10.0, while the actual score was 9.2.PHP FoundationConfirmed
CERT-EU said cVE-2026-109618 stems from memory corruption during out-of-memory handling, while CVE-2026-109619 arises from stale global state.CERT-EU, via HoodlineAttributed
The PHP project confirmed working attacks for each flaw on different server setups, according to Censys.Censys, via HoodlineAttributed
Censys identified 6,292,667 hosts and 115,000,393 web properties matching its PHP exposure queries on Wednesday.Censys, via HoodlineAttributed
Palo Alto Networks Unit 42 said unit 42 researchers said they observed proof-of-concept exploit code for both vulnerabilities.Palo Alto Networks Unit 42, via HoodlineAttributed
At least one European government took its website offline as a precaution, according to Palo Alto Networks’ threat brief.Palo Alto Networks, via HoodlineAttributed
CISA had not observed exploitation of the vulnerabilities when its advisory was published, according to NBC News.NBC News, via HoodlineAttributed
W3Techs reported that PHP was used by 69.3% of websites whose server-side programming language was known in October 2026.W3Techs, via HoodlineAttributed
CISA published its report on Oct 23, 2026.CISAConfirmed

Could not verify

  • Whether the reported exploitation attempts achieved code execution is not established
  • How many systems were actually vulnerable or compromised is not established
  • Whether all reported exposure measurements use comparable methods is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok