Emergency PHP release fixes two critical flaws after a leak

What happened

The PHP project released emergency fixes on Wednesday 21 October for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker with no account run code on a web server. ^{[1, 2, 16]}

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's security team rates both flaws 9.2 out of 10 on CVSS version 4.0, the standard severity scale. It called the risk highest for Apache servers running PHP as a module, mod_php, where a demonstrated attack works before any site code runs. ^{[1, 2, 11]}

Why it matters

The flaws sit in PHP itself, so a site can be exposed even when its own code is sound, wrote Wiz, whose researchers call them PHP2Shell and put PHP's share of websites at 70 percent. PHP 8.1 and older get no fix from the project, and Cisco Talos estimated that about half of PHP systems will not receive a patch. ^{[1, 4, 8]}

How a leak moved the date

The release was planned for Thursday 22 October, the PHP Foundation said. The two CVE numbers began circulating online on Tuesday 20 October with a wrong release time and a wrong score of 10.0, so the project moved the release a day earlier. ^[3]

Calif, one of the firms that reported the flaws, posted a video of a working attack by mistake, which sped up work on other exploits, the foundation said. It said Chainguard published images containing the fix more than six hours early; Chainguard's chief executive told The Record he had seen exploit attempts and made a judgment call. ^{[3, 16]}

Attacks, and where sources differ

Amazon's threat intelligence team said a decoy server recorded an exploit attempt on Saturday 17 October, four days before disclosure, and that the flaws are now being broadly exploited. Cloudflare said it saw attack traffic against its customers and had turned on firewall rules by default at 03:02 UTC on Wednesday. ^{[5, 6]}

In the Netherlands, sites including DigiD and the lower house of parliament's were taken offline as a precaution, the broadcaster NOS reported. South Korea's science ministry raised its civilian cyber alert to 'caution' on Thursday 22 October and started its emergency response, Newsis reported. ^{[13, 14]}

PHP's own notices list versions 8.2 to 8.5 as affected, while Wiz, Cloudflare and Talos say every release since PHP 5.4. Before the release, SecurityWeek cited public reporting that all versions from PHP 5 onwards were affected. ^{[2, 4, 6, 8, 12]}

What settles it next

Cisco's advisory is marked interim: it lists products still under investigation and says none is yet known to be affected. CISA's catalog of flaws known to be exploited did not list either flaw in its edition of 21 October. PHP 8.2 receives no security fixes after Thursday 31 December, the project said. ^{[7, 9, 1]}

Who it reaches

Cisco Systems (CSCO) is adjacent: it published an advisory checking its products against the flaws, and its Talos unit released detection rules. Cloudflare (NET) is adjacent: its firewall rules shield customers' sites, and it reported attack traffic against them. ^{[7, 8, 6]}

Amazon.com (AMZN) is adjacent: its threat intelligence recorded the 17 October attempt, and AWS published firewall guidance. Alphabet (GOOGL) is adjacent: Google Cloud said its platform is not vulnerable but customers' PHP apps may be, and Wiz used Google's Gemini model. Qualys (QLYS) is adjacent: it published guidance on finding vulnerable PHP installations. ^{[5, 10, 4, 15]}