Two Critical PHP Bugs, Working Exploits
KrebsOnSecurity reported on October 21, 2026 that a pair of critical vulnerabilities in PHP could let an attacker run code of their choosing on affected web servers. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Experts say working exploits exist, and Cloudflare reported detecting some exploitation and deployed web application firewall rules.
Krebs noted that nearly 70 percent of websites need to update their core software, and that some sites may serve "404" or "Page Not Found" errors as operators patch.
Key Facts
| Attribute | Detail |
|---|---|
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Impact | Remote code execution |
| Affected | Web servers running PHP 5.4 or later; Wiz says every PHP version released in the last decade is affected by at least one of the two |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Exploitation | Working exploits exist; some in-the-wild exploitation detected |
| Credited | Wiz, OpenAI, and Calif; the PHP team coordinated the response |
Censys counted about 2.58 million Internet-facing hosts and 54.9 million web properties running PHP. Platforms built on PHP include WordPress, Drupal, Joomla, and Magento. Reuters reported European government websites going offline. Wiz expects mass exploitation aimed at installing web shells.
One reader comment on the Krebs article disputes the "zero-day" label, saying the PHP Foundation knew of the bugs in 2024. The article does not address this claim, so treat it as unverified.
What to Do
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch.
- Check your OS or hosting provider for updated packages. Ubuntu had already released updated PHP packages at the time of reporting.
- If you run an older branch that has no fix, migrate to a supported version as soon as possible and use WAF rules in the meantime.
- Hunt for web shells. Look for recently modified
.phpfiles in web roots and upload directories, and for unexpected outbound connections from web servers. - Track advisories from vendors and the SANS Internet Storm Center for updates.