Overview
- The PHP project published emergency releases for supported 8.2–8.5 branches on Wednesday, October 21, to fix two critical memory-safety flaws tracked as CVE-2026-109618 and CVE-2026-109619.
- Security telemetry shows attackers probed and attempted exploitation before public disclosure, with Amazon/AWS recording activity on October 17 that resets the incident hunting window.
- Honeypot operators led by Adel Karimi at Perplexity and independent researchers have recorded confirmed remote code execution and usable shells against Apache mod_php instances.
- Fixing systems requires more than installing packages: operators must restart web workers, confirm the running SAPI binary is updated, apply vendor backports for older builds, and hunt logs and memory for compromises predating the patch.
- Frontier AI helped researchers turn a long-standing PHP engine weakness into practical exploits and has also sped attacker scanning and exploit ranking, raising the risk of targeted campaigns and continued opportunistic scanning.