The PHP Foundation released emergency security updates on Wednesday for two critical vulnerabilities in the PHP programming language, which powers roughly 70% of websites whose server-side language is known, according to W3Techs. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 on the CVSSv4 scale and allow unauthenticated remote code execution.
The fixes arrived in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at approximately 13:35 UTC, a few minutes ahead of the scheduled release. The security advisory stated: "All PHP users are strongly encouraged to update immediately."
Government agencies respond
As a precaution, Finland's state IT center, Valtori, began taking public web services offline, public broadcaster Yle reported. The Dutch national cybersecurity agency took down its own website, and France's Interior Ministry said its prefecture websites were "temporarily taken offline pending the release of a security patch by the framework's publisher."
CERT-EU, the EU's cyber emergency team, advised organizations that could not patch to "consider isolating internet-facing applications from public networks until a fix is available." Agencies in Australia, Japan and the U.K. issued similar guidance, according to Reuters.
How the vulnerabilities work
The first flaw, CVE-2026-109618, occurs when PHP runs out of memory while handling a request and later treats incomplete data as finished. The second, CVE-2026-109619, allows data from one visitor's request to remain in memory and be accessed by a subsequent request.
PHP said the risk is highest on servers using the common Apache module known as mod_php, where a demonstrated exploit works "before any application code runs," meaning website defenses such as login screens and security plugins are bypassed. Researchers pointed to PHP's upload-progress feature, enabled by default for more than a decade, as one confirmed attack vector.
Early attacks and leaked details
Details of the vulnerabilities leaked before the official disclosure. On Tuesday, a post on the Hacker News forum claimed two PHP flaws would be disclosed later that week, though the poster admitted having "no evidence beyond 'source: trust me, bro.'" Security firm watchTowr confirmed the bugs were real and under embargo, and PHP moved its release up a day.
Cloudflare CTO Dane Knecht wrote on X early Wednesday that the company was "seeing early attacks emerging" and updating mitigations, nearly six hours before the patch shipped. Cloudflare deployed emergency firewall rules to all customers, including free users, but Knecht called them "a stopgap only."
What the viral claims got wrong
Viral posts on X claimed PHP versions dating back to 2004 were vulnerable. That traces to early estimates that everything since PHP 5 was affected, which CERT-EU said was based on social media posts. E-commerce security firm Sansec places the affected range at PHP 5.4 and later, meaning 2012 rather than 2004.
PHP only provides official releases for versions 8.2 and newer, but its security team also published bare-bones source-code patches for 7.4, 8.0 and 8.1, and Linux distributions are backporting fixes. Security firm Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older on October 20, or 59% of the roughly 1.5 million that publicly show a version. A single shared-hosting server can carry many websites, so the number of affected sites is higher.
Some threads also conflated the PHP flaws with an unrelated Node.js security update scheduled for the same day.
What website owners should do
Regular users do not need to install anything; the responsibility falls on website owners and hosting companies. Wordfence warned that automatic updates will not apply this fix and advised site owners to confirm who is responsible for updating PHP on their servers. Anyone on PHP 8.1 or older should plan an upgrade.
"The only thing I can say is that the only mitigation is patching / upgrading PHP," PHP core developer Gina Peter Banyard said on Mastodon. "I sadly know too much."
PHP 8.2 will reach end of life on December 31, 2026, after which it will no longer receive security patches. The PHP Foundation also urged users relying on the volunteer-maintained rpms.remirepo.net repository to move to distribution packages or build from source, as the repository would not have updates that day.
Sansec said it expects "mass attacks to start within 15 minutes of the release." When a different PHP flaw went public in June 2024, Akamai observed exploit attempts against its decoy servers within 24 hours.
