official (PHP security team advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, Oct 21; php.net release notes, Oct 21 and Oct 20; CERT-EU Security Advisory 2026-018; UK NCSC) · media (BleepingComputer; BBC News) · industry (watchTowr; Cloudflare)
PHP ships emergency fixes for two critical flaws that let attackers take over web servers
The fix for two of the worst flaws PHP has had is out. The PHP project says every installation serving web requests is at risk, and that nothing short of updating makes a server safe.
Key facts
- CVEs
- CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state), both critical, CVSS v4.0 9.2 (PHP security team)
- Fixed versions
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released Oct 21; advisories published 9:34 AM ET (PHP security team)
- Affected
- Versions before those releases on the 8.2 to 8.5 branches; all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed (PHP security team)
- Highest risk
- Apache with mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs (PHP security team)
- Older versions
- PHP 8.1 and older get no project updates; the team published minimal source backports for 7.4, 8.0 and 8.1 (PHP security team)
- Guidance
- Update immediately; mitigations reduce exposure but do not make an installation safe (PHP security team). Where patching is not feasible, consider isolating or taking systems offline (CERT-EU; UK NCSC)
- Exploitation
- No official confirmation of attacks in the wild; not in CISA's Known Exploited Vulnerabilities catalog as of Oct 21 morning. Cloudflare's chief technology officer said on X it is seeing early attacks
There are no complete mitigations, updating is the only safe choice.
PHP development team, PHP 8.5.12 release notes, Oct 21
Note
The PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday, October 21, to fix two critical vulnerabilities that can allow unauthenticated remote code execution. Its advisories for CVE-2026-109618 and CVE-2026-109619 were published at 9:34 AM ET, ahead of the 10 AM ET release it had announced the day before, and rate both 9.2 under CVSS v4.0.
The project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. One flaw lets out of memory handling leave request data half built; the other lets internal state outlive the memory behind it, so a later request on the same worker uses it.
The team says there are no complete mitigations and updating is the only safe choice. PHP 8.1 and older no longer get updates from the project, though it published minimal source backports for 7.4, 8.0 and 8.1. CERT-EU and the UK's National Cyber Security Centre advised organisations to patch at once and, where that is not possible, to consider isolating systems or taking them offline.
The flaws leaked before they were fixed. The security firm watchTowr told BleepingComputer on Tuesday that details had escaped an embargo and that it had reproduced one of them. On Wednesday morning, Cloudflare's chief technology officer said on X that the company was seeing early attacks. No official body has confirmed exploitation, and CISA had not added either flaw to its catalog of exploited vulnerabilities.
The fix is out now. So is the knowledge of what it fixes, and the servers that never get updated will be the ones that learn it first.
Why it matters
PHP runs underneath a large share of the web, including WordPress, Drupal and Magento sites, and these flaws can be triggered by a request from anyone. The details leaked before the fix, and older PHP versions that many servers still run get no official update.
Sources
- PHP security team: Security advisory, critical remote code execution vulnerabilities, update now (php.net, Oct 21 2026)
- GitHub advisory GHSA-w8hw-w9fx-j79w: CVE-2026-109618, RCE via OOM corruption (PHP security team)
- GitHub advisory GHSA-6wmf-4rv5-p3rp: CVE-2026-109619, RCE via stale global state (PHP security team)
- PHP: upcoming critical security release notice (php.net, Oct 20 2026)
- CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP
- BleepingComputer: PHP warns admins of two critical flaws, emergency patches coming (Oct 20 2026)
- BBC News: Cyber chiefs tell websites to make critical safety update or go offline (Oct 21 2026)
Primary + secondary attribution as listed.
Doom Signals desk · About · Contact · Corrections. Spotted an error? Write the desk; fixes go on the public log.