Overview
- The PHP project released emergency fixes for two critical runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Oct. 21, 2026.
- The bugs cause memory corruption during request handling and permit unauthenticated remote code execution in the PHP engine itself, putting any web server that runs PHP for request handling at risk.
- Multiple vendors saw exploitation attempts before public disclosure and attack traffic jumped from thousands to millions of probes within hours after the Oct. 21 release.
- As of Oct. 23, patched PHP builds and some vendor backports are available but mass scanning and attempted weaponization continue and no confirmed successful in-the-wild RCEs have been reported; PHP also published a temporary mitigation for a separate configuration-based RCE (CVE-2026-115560).
- Because about 70% of websites use PHP and many instances run end-of-life or embedded versions, organizations must quickly inventory PHP runtimes, apply official patches or vendor backports, audit systems for compromise, and prioritize fixes measured in hours not days.