Overview
- The PHP project issued emergency fixes on Wednesday for two runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution in the PHP request handler.
- Amazon Threat Intelligence saw exploit activity on October 17, four days before the public advisory, showing attackers probed honeypots while the vulnerability was still under embargo.
- Cloudflare and multiple security firms recorded an explosion of scanning and proof‑of‑concept activity after the October 21 fixes, growing from thousands of attempts to millions of probes within hours.
- Patching is the only complete fix but progress lags because tens of millions of internet‑facing PHP instances run EOL or unpatched versions, and embedded backends used by mobile apps and third‑party services increase discovery and remediation work.
- Researchers report attempts to weaponize the bugs with Mirai‑derived payloads and an ASLR‑bypass exploit has been demonstrated, yet vendors say no widespread, confirmed in‑the‑wild remote code executions have been validated so organizations should patch immediately and hunt for signs of compromise.