Overview
- The PHP project released emergency updates on Wednesday, Oct. 21, 2026, that fix two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale.
- The flaws sit in the PHP runtime and affect every installation that serves web requests, with Apache's mod_php judged the highest risk because a single unauthenticated request can trigger exploitation before application code runs.
- PHP shipped fixes for supported branches (8.2 through 8.5) and provided source backports for some older releases while distributors and vendors work to roll the patches into packages.
- Security firms and infrastructure providers reported early exploit attempts and deployed temporary WAF rules and other stopgaps, but PHP and researchers say only installing the runtime updates fully mitigates the vulnerabilities.
- Researchers estimate millions of internet-exposed hosts may be vulnerable, prompting CERTs in the EU, UK, Australia and others to urge immediate patching or taking affected sites offline when updates cannot be applied.