Overview
- PHP issued emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619 and maintain that upgrading the runtime is the only complete remediation.
- Amazon Threat Intelligence recorded exploitation attempts against the flaws as early as October 17, indicating attackers probed the bugs before public disclosure.
- Exploit scanning surged from thousands to millions of attempts within hours of the patch release, but security firms report no publicly confirmed successful remote code execution in live systems so far.
- Researchers and vendors have published proof-of-concept code and at least one ASLR-bypass exploit that can achieve execution on specific production configurations, raising the urgency to patch.
- Large numbers of internet-facing PHP instances remain unpatched or on end-of-life branches, forcing image and vendor updates, temporary takedowns, and immediate log and process audits to check for compromise.