What happened

On October 21, 2026, the PHP team released an emergency security update. The reason was a leak of details regarding two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, just ahead of their scheduled release. Both received a severity score of 9.2 out of 10 on the CVSS scale.

The core threat

This is a classic Unauthenticated Remote Code Execution: the attack requires no passwords, cookies, or administrator privileges. Simply sending a specially crafted request is enough to execute an arbitrary script, deploy a shell, launch a crypto miner, or dump the database.

Who is at risk

All PHP installations processing web requests are under fire: integrations with Apache (mod_php), PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP. The potential scope spans from WordPress blogs to large-scale e-commerce projects.

The exploit is already in the wild

According to Cloudflare analysts, the vulnerability is already being exploited in the wild, and automated mass-scanning scripts are circulating in the dark web. There is no longer a window for relaxed update testing.

What to do now

Immediate updates to secure releases are required: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Owners of legacy versions (PHP 8.1 and below) for which no patches are provided must urgently upgrade their stack or protect applications with strict CDN-level WAF rules until migration is complete.