Critical PHP Remote Code Execution Flaws CVE-2026-109618 and CVE-2026-109619 Patched Amid Active Exploitation Attempts
What happened
On October 21, 2026, the PHP project released emergency security patches for two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated attackers to execute arbitrary code on web-serving deployments.
The Context
* Flaws hit core execution environments: The vulnerabilities carry a CVSS 9.2 severity rating and impact all supported versions across web setups, including PHP-FPM, containers, and mod_php. * Exploits appeared before fixes landed: Active exploitation attempts were logged by AWS MadPot starting October 17, four days ahead of the scheduled coordinated disclosure. * Global regulators enforced rapid compliance: The U.S. Cybersecurity and Infrastructure Security Agency added both bugs to its Known Exploited Vulnerabilities catalog on October 26, mandating remediation across federal systems by October 29.
The Number
— the estimated share of the web powered by PHP, creating a single point of structural risk across enterprise applications, content management systems, and hosting platforms worldwide.
Takeaway
Expect cloud providers and enterprise IT teams to accelerate patch cycles while isolating legacy services that cannot safely upgrade to patched versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12.
Latest tech news, product reviews, and analysis for consumers and professionals.
"CNET delivers accessible and detailed technology reporting, including trusted product reviews and how-to guides."
— A47 Editor
Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg
A critical vulnerability in PHP, the programming language underpinning roughly 70% of websites worldwide, has triggered a global rush to patch vulnerable systems, with the base report framing the flaw as only the most visible part of a wider web secu...
Community posts including AI/ML tutorials and news.
"Open platform where developers share AI learnings."
— A47 Editor
Black October: what one week of PHP2Shell, LiteLLM and eMudhra says about who scans your code
A week of security disclosures between 17 and 24 October 2026 saw the PHP interpreter ship emergency patches for two pre-authentication remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, found with frontier AI model...
Covers blockchain, cryptocurrency news, project analysis, and market insights.
"Cointelegraph is a leading crypto-focused media outlet known for timely news, analysis, and educational content related to blockchain and digital assets."
— A47 Editor
PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO
Cointelegraph reports that Immunefi CEO Mitchell Amador warned a PHP flaw shows an AI-driven 'vulnerability apocalypse' is on schedule, saying websites could remain compromised for weeks, particularly smaller sites slower to adopt emergency upgrades.
AI/ML research and technology news.
"Sister site to Phys.org focusing on tech research."
— A47 Editor
AI-assisted discovery exposes decade-old PHP flaw that could put millions of websites at risk
Governments and organizations worldwide scrambled on Oct. 21, 2026, to fix a decade-old vulnerability in PHP, the programming language that powers much of the web and could give hackers access to data and control of websites. The flaw drew urgent war...
Latest AI/ML research news and breakthroughs.
"Aggregated research highlights across institutions."
— A47 Editor
'Tech debt coming due': AI-found flaw signals chaos ahead
Companies and government agencies rushed this week to patch two critical flaws in PHP, the programming language that runs a large share of the world's websites, after the vulnerabilities were identified with the help of AI tools. The base report fram...
Tech news, hardware, and AI tools coverage.
"PC/tech site increasingly covering AI hardware and apps."
— A47 Editor
AI will keep uncovering critical software flaws for years, says Cloudflare CEO
Cloudflare CEO Matthew Prince told Reuters that the company is aware of additional severe vulnerabilities in other critical software, which he did not name, and said AI will continue uncovering such flaws for years. He compared them to recent PHP bug...
Covers Bitcoin plus altcoin news, market updates, and educational resources.
"Bitcoin.com provides news, market data, and guides focused on Bitcoin and the wider crypto industry."
— A47 Editor
PHP Flaw Shakes Internet, Bitcoin Flashes Bull Signal, and More – Weekly Recap
The base article, a Bitcoin.com weekly recap, reports that a flaw in PHP, a widely used web programming language, has shaken the internet, while Bitcoin flashed a bull market signal amid fresh ETF inflows, according to CryptoQuant CEO Ki Young Ju, wh...