Overview
- The PHP development team released emergency fixes on Wednesday, October 21, 2026, to address two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 that carry a 9.2 CVSS v4.0 rating.
- Security agencies in the EU, US, UK, Australia and others advised immediate patching or taking public-facing sites offline when fixes cannot be applied, and several governments temporarily shut down services as a precaution.
- Researchers at Calif and Wiz used advanced AI models to discover and verify the memory‑handling bugs that enable unauthenticated remote code execution, a finding that highlights both AI’s defensive use and its dual‑use risk.
- Cloudflare, Amazon and other providers reported early exploitation attempts and deployed temporary web application firewall rules and mitigations, but warned these measures do not replace the official PHP updates.
- A major remaining risk is the long tail of older or unmanaged PHP installs that do not have immediate official patches, which will need vendor backports, hosting-provider updates or continued isolation and could take months to secure.