Two critical security flaws in PHP, the server-side programming language that powers approximately 70 percent of websites with a known backend technology, have triggered widespread concern among administrators, hosting providers, and government agencies. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and permit unauthenticated remote code execution, enabling attackers to run arbitrary commands on affected servers without credentials.

PHP Foundation researchers disclosed the issues with advance notice on October 20, scheduling emergency releases for the following day at 14:00 UTC. Details surfaced publicly earlier than planned through a forum post, prompting the foundation to accelerate the timeline slightly. Official patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 became available around 13:35 UTC on October 21, accompanied by a strong recommendation for all users to update immediately.

How the Vulnerabilities Function

The first flaw arises when PHP exhausts memory during request processing and subsequently treats incomplete data structures as fully formed. The second allows residual data from one request to remain accessible in memory, where a subsequent request can exploit it. In practical terms, an attacker can craft a specially formed web request that causes the server to execute attacker-controlled code before any application-level protections, such as login systems or security plugins, become active.

Risk is elevated on servers configured with Apache’s mod_php module. One confirmed entry point involves PHP’s upload-progress feature, which has remained enabled by default for more than a decade even though few sites rely on it. Security researchers noted that successful exploitation can occur prior to the execution of any website code, rendering many conventional defenses ineffective.

Early Disclosure and Observed Attacks

An embargo intended to keep technical details private until patches were ready was broken when a Hacker News post referenced the forthcoming flaws. Security firm watchTowr later confirmed the vulnerabilities were authentic and under embargo. Cloudflare reported early attack attempts nearly six hours before the official patches shipped and deployed emergency web application firewall rules across its network as a temporary measure.

The PHP Foundation had warned that an earlier release would occur if details became public or active exploitation evidence emerged. Once the patches were published, researchers anticipated rapid reverse-engineering of the changes, with mass exploitation attempts expected shortly afterward based on patterns from prior PHP disclosures.

Government and Institutional Responses

Several national agencies moved preemptively. Finland’s state IT center began taking public web services offline as a precaution. The Dutch national cybersecurity agency disabled its own website. France’s Interior Ministry reported that prefecture websites were temporarily taken offline pending the availability of the security update.

CERT-EU advised organizations unable to apply patches immediately to isolate internet-facing applications from public networks. Agencies in Australia, Japan, and the United Kingdom issued similar guidance. The NSA recommended that organizations using PHP consider shutting down affected sites until updates could be applied.

Scope of Exposure and Legacy Systems

PHP underlies major platforms including WordPress and Drupal, as well as numerous business sites and control panels. Estimates place the number of internet-facing hosts advertising PHP 8.1 or older at roughly 884,000, representing about 59 percent of systems that publicly report a version. Because shared hosting servers often support multiple sites, the total number of affected websites is substantially higher.

Official supported releases cover only PHP 8.2 and newer. The security team published minimal source-code patches for versions 7.4, 8.0, and 8.1, while various Linux distributions prepared their own backports. PHP 8.2 itself reaches end of life on December 31, 2026, after which it will receive no further official security updates.

Security researchers scanning crypto-related infrastructure identified potential exposure among platforms, decentralized finance services, and wallet providers that rely on PHP-based web systems. The concern centers on the underlying server software rather than blockchain components themselves.

Recommended Actions for Operators

Website owners and administrators are advised to inventory all PHP installations, including those embedded in third-party products, and prioritize internet-facing systems. Hosting providers must be contacted to confirm whether updates have been applied, as automatic application updates will not address the core language flaws. Systems running unsupported versions require either an upgrade path or temporary isolation.

Detection of potential compromise may include unexpected PHP processes launching shells, Python interpreters, or tools such as curl to retrieve external files. Cloudflare’s temporary rules and similar mitigations offer interim protection but are not substitutes for full patching.

Average internet users face no direct requirement to update personal devices, as the responsibility rests with website operators and hosting companies. However, compromised servers can be leveraged to serve malicious pages capable of capturing credentials or redirecting users to fraudulent destinations, underscoring the importance of rapid remediation across the ecosystem.