Overview
- The PHP Project released fixes for CVE-2026-109618 and CVE-2026-109619 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after researchers disclosed a pair of RCE flaws that affect PHP 8.2 through 8.5 and require immediate updating.
- Researchers and vendors reported active exploitation attempts before public disclosure, with Amazon's MadPot honeypots detecting the first probe and security networks recording a surge in exploit traffic that grew to millions of attempts within hours of the patch release.
- The bugs work inside the PHP engine and can trigger unauthenticated code execution via memory corruption and stale global state, so application‑level defenses do not block the exploit and only the patched PHP binaries fully fix the issue.
- Operational risk remains high because updating packages alone is not enough; hosts must run the new binaries, PHP worker processes and containers must be restarted or replaced, and legacy or vendor‑maintained builds may need backports or isolation.
- Beyond immediate fixes, the incident highlights how AI‑assisted analysis accelerated turning long‑dormant engine flaws into working exploits and is prompting security teams to change disclosure, inventory and rapid‑patching practices to reduce future windows of exposure.