NEWS

Widespread PHP Flaws CVE-2026-109618 and CVE-2026-109619 Under Active Exploitation, Causing Site Outages

Two critical PHP flaws affect nearly every version in the last decade. Working exploits are circulating and some sites have gone offline. Patch now.

Dylan H.

News Desk

October 22, 2026
3 min read
Widespread PHP Flaws CVE-2026-109618 and CVE-2026-109619 Under Active Exploitation, Causing Site Outages

Overview

Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, are being described as one of the most consequential web-server security events in recent memory. KrebsOnSecurity reported on October 21 that nearly 70 percent of websites may need to update their core software, and that working exploits already exist.

What Was Disclosed

  • CVEs: CVE-2026-109618 and CVE-2026-109619
  • Affected: Web servers running PHP 5.4 or later. Wiz says every PHP version released in the last decade is affected by at least one of the two flaws.
  • Impact: Per Cloudflare, exploitation can cause denial of service, remote code execution, and data exposure.
  • Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Wiz says the flaws had been present for decades and were hard to exploit until frontier AI models lowered the barrier. OpenAI took part in the research and outreach and called them "one of the most impactful security issues in recent memory." Calif is credited with finding the flaws and published a technical writeup.

Exploitation and Scale

  • Cloudflare reports detecting some exploitation in the wild and deployed WAF rules at 3:02 am UTC to block attack traffic.
  • Censys counted about 2.58 million internet-facing hosts and 54.9 million web properties running PHP.
  • Reuters reported that government websites in Europe and elsewhere went offline after disclosure, which is why users may see 404 or "Page Not Found" errors on affected sites.
  • Wiz expects mass exploitation to install web shells and compares the situation to Log4Shell.

Content management systems built on PHP, including WordPress, Drupal, Joomla, and Magento, are exposed through their underlying runtime.

What to Do

  1. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Distribution vendors such as Ubuntu have shipped updated packages.
  2. Enable WAF protections (for example, Cloudflare's managed rules) as a stopgap. These do not replace patching.
  3. Inventory PHP use, including containers, shared hosting, and legacy internal apps on old PHP branches that no longer receive fixes.
  4. Hunt for compromise: check for unexpected .php files, new admin accounts, and unusual outbound connections from web servers.
  5. Plan migrations for any PHP 5.x or 7.x systems, which are unlikely to receive an official fix.

Why It Matters

The combination of a near-universal install base, public exploit code, and decades-old code paths makes this an unusually broad patching event. Organizations running PHP-based sites should treat it as an emergency change rather than waiting for a regular maintenance window.

Sources