---
title: "Red code for half the internet: emergency PHP patches fix critical RCE vulnerabilities"
description: "On October 21, 2026, the PHP team urgently released patches against two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) whose details leaked prior to release. The exploit is already active in the wild."
date: 2026-10-21T15:19:11.674Z
lang: en
url: https://xab.info/en/posts/php-rce-critical-vulnerability-emergency-patch
tags: [php, cybersecurity, rce-vulnerability, web-security, cloudflare]
author: "Alexander Buran, Roman V."
publisher: "XAB.info"
---

# Red code for half the internet: emergency PHP patches fix critical RCE vulnerabilities

![Emergency PHP security update to fix critical vulnerabilities](https://xab.info/media/2026/10/21/php-rce-critical-vulnerability-emergency-patch/php-rce-critical-vulnerability-emergency-patch-1.webp)

## Key Points

- The PHP team urgently released patches against two critical RCE vulnerabilities with a CVSS score of 9.2.
- A pre-release leak of exploit details has triggered massive hacking attempts tracked by scanners.
- Secure releases: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; no patches are provided for versions 8.1 and below.

### What happened

On October 21, 2026, the PHP team released an emergency security update. The reason was a leak of details regarding two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, just ahead of their scheduled release. Both received a severity score of 9.2 out of 10 on the CVSS scale.

### The core threat

This is a classic Unauthenticated Remote Code Execution: the attack requires no passwords, cookies, or administrator privileges. Simply sending a specially crafted request is enough to execute an arbitrary script, deploy a shell, launch a crypto miner, or dump the database.

### Who is at risk

All PHP installations processing web requests are under fire: integrations with Apache (mod_php), PHP-FPM, php-cgi, LiteSpeed, and FrankenPHP. The potential scope spans from WordPress blogs to large-scale e-commerce projects.

### The exploit is already in the wild

According to Cloudflare analysts, the vulnerability is already being exploited in the wild, and automated mass-scanning scripts are circulating in the dark web. There is no longer a window for relaxed update testing.

### What to do now

Immediate updates to secure releases are required: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Owners of legacy versions (PHP 8.1 and below) for which no patches are provided must urgently upgrade their stack or protect applications with strict CDN-level WAF rules until migration is complete.

## Fact-Check & Sources

- [Ручное создание украшений ручной работы в ремесленной мастерской - Сток картинки...](https://www.istockphoto.com/ru/%D1%84%D0%BE%D1%82%D0%BE/%D1%80%D1%83%D1%87%D0%BD%D0%BE%D0%B5-%D1%81%D0%BE%D0%B7%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5-%D1%83%D0%BA%D1%80%D0%B0%D1%88%D0%B5%D0%BD%D0%B8%D0%B9-%D1%80%D1%83%D1%87%D0%BD%D0%BE%D0%B9-%D1%80%D0%B0%D0%B1%D0%BE%D1%82%D1%8B-%D0%B2-%D1%80%D0%B5%D0%BC%D0%B5%D1%81%D0%BB%D0%B5%D0%BD%D0%BD%D0%BE%D0%B9-%D0%BC%D0%B0%D1%81%D1%82%D0%B5%D1%80%D1%81%D0%BA%D0%BE%D0%B9-gm2205737329-623110976) - Stock image containing no information about PHP vulnerabilities.
- [Рабочим является производство динамиков и громкоговорителей на заводе. Ручное создание ...](https://www.istockphoto.com/ru/%D1%84%D0%BE%D1%82%D0%BE/%D1%80%D0%B0%D0%B1%D0%BE%D1%87%D0%B8%D0%BC-%D1%8F%D0%B2%D0%BB%D1%8F%D0%B5%D1%82%D1%81%D1%8F-%D0%BF%D1%80%D0%BE%D0%B8%D0%B7%D0%B2%D0%BE%D0%B4%D1%81%D1%82%D0%B2%D0%BE-%D0%B4%D0%B8%D0%BD%D0%B0%D0%BC%D0%B8%D0%BA%D0%BE%D0%B2-%D0%B8-%D0%B3%D1%80%D0%BE%D0%BC%D0%BA%D0%BE%D0%B3%D0%BE%D0%B2%D0%BE%D1%80%D0%B8%D1%82%D0%B5%D0%BB%D0%B5%D0%B9-%D0%BD%D0%B0-%D0%B7%D0%B0%D0%B2%D0%BE%D0%B4%D0%B5-%D1%80%D1%83%D1%87%D0%BD%D0%BE%D0%B5-%D1%81%D0%BE%D0%B7%D0%B4%D0%B0%D0%BD%D0%B8%D0%B5-gm1388741372-446283498) - Stock image containing no information about PHP vulnerabilities.

## FAQ

### Which PHP versions fixed the vulnerabilities?

PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been declared secure.

### What should owners of PHP 8.1 and below do?

No patches are available for these versions: users must urgently upgrade their stack or protect applications with strict WAF rules at the CDN level until migration is complete.

### How dangerous are these vulnerabilities?

Both received a 9.2 out of 10 CVSS score and allow unauthenticated arbitrary code execution.