PHP Project Releases Emergency Patches for Critical Remote Code Execution Vulnerabilities

PHP powers approximately 70-75% of the world's websites, making these vulnerabilities a significant threat to global web security.

• Emergency patches were released on October 21, 2026, for critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619).
• Millions of exploitation attempts were reported within hours of the vulnerabilities being disclosed, prompting urgent global patching efforts.
• Older PHP versions remain vulnerable, as patches are only available for supported branches 8.2 and newer.

• PHP's prevalence: The language is foundational for web development, with a vast majority of websites relying on it for server-side processing.
• Vulnerability origins: The flaws stem from improper handling of request states during out-of-memory conditions, existing undetected since at least 2004.
• Coordinated response: The vulnerabilities were discovered through collaborative research involving multiple security firms and the PHP team, leading to a rapid patch release.

On October 21, 2026, the PHP project released emergency security updates to address two critical vulnerabilities that allow unauthenticated remote code execution on web servers. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were discovered through a coordinated effort involving researchers from Calif, OpenAI, and Wiz. The flaws affect all PHP installations serving web requests, including those dating back to PHP 5, released in 2004. However, patches are only applicable to supported versions 8.2 and newer.

The vulnerabilities were first identified by Ryan Austin of Calif in early August 2026, with Wiz independently discovering them weeks later. This led to a collaborative effort among PHP maintainers, Cloudflare, and other security firms to prepare fixes. The urgency escalated when details of the vulnerabilities leaked on forums on October 20, prompting an accelerated release of the patches.

Upon release, security firms reported immediate scanning and exploitation attempts, with Cloudflare observing millions of attempts within hours. The vulnerabilities were particularly exploitable against default configurations, especially mod_php, which is commonly used in many web hosting environments. This rapid exploitation highlights the critical need for organizations to patch their systems promptly to avoid potential breaches.

National Computer Emergency Response Teams (CERTs), including CERT-EU, issued urgent advisories recommending immediate patching or isolation of affected systems. Many organizations temporarily took their websites offline to implement the necessary updates. Cloud providers and hosting services quickly deployed patches, but the lack of updates for older PHP versions leaves a significant number of installations vulnerable.

The aftermath of this incident has led to heightened awareness around runtime security and the decommissioning of legacy PHP versions. While no major market disruptions have been reported, the focus on securing web applications has intensified, with organizations urged to rotate credentials due to potential memory exposure from the vulnerabilities.

• Web developers: Immediate need to update PHP versions and patch vulnerabilities in applications.
• Businesses relying on PHP: Increased risk of data breaches and operational disruptions.
• Cloud service providers: Urgent deployment of patches to protect client infrastructures.
• Security teams: Heightened alertness and need for rapid response to potential exploitation attempts.

• Patch adoption rates: Monitoring how quickly organizations implement the patches will indicate the overall security posture of the web.
• Exploitation trends: Tracking ongoing exploitation attempts will reveal the effectiveness of the patches and the urgency for organizations to upgrade.
• Legacy PHP decommissioning: Observing how many organizations transition away from unsupported PHP versions will highlight shifts in web development practices.