Overview
- The PHP project released emergency fixes for the engine on Oct. 21 to address two critical bugs, CVE-2026-109618 and CVE-2026-109619, that enable unauthenticated remote code execution and carry a CVSS score of 9.2.
- Researcher Adel Karimi confirmed usable remote code execution against Apache mod_php honeypots on Oct. 24, turning earlier scanning and unsuccessful attempts into verified in-the-wild exploitation.
- CISA added the two CVEs to its Known Exploited Vulnerabilities catalog on Oct. 27 and ordered Federal Civilian Executive Branch agencies to remediate affected systems by Oct. 29 under BOD 26-04.
- Telemetry and scans show a very large exposed surface with tens of millions of PHP services still running vulnerable versions, which makes patching complex for legacy, embedded, and third-party bundled installs.
- The PHP Foundation issued Windows builds on Oct. 26 to also fix a related Brotli decoder out-of-bounds bug that could be reached via cURL, highlighting the wider supply-chain and configuration work operators must do and the need to hunt for past compromises.