Overview
KrebsOnSecurity reported on October 21, 2026 that a pair of critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow an attacker to run code on a vulnerable server. The article said nearly 70 percent of websites needed to update their core software, and that outages were expected as sites patched or were taken offline.
Affected and Fixed Versions
Per the report, all servers running PHP 5.4 or later are affected. Wiz says every PHP release of the last decade is hit by at least one of the two bugs.
| Branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Ubuntu has shipped updated PHP packages. No CVSS scores were given in the source. The report called the flaws "zero-day"; a reader comment disputes that, and the claim is unverified.
Exploitation
- Experts say working exploits exist and the bugs are already exploited in the wild.
- Cloudflare detected some exploitation and deployed WAF rules at 3:02 am UTC.
- Wiz expects mass exploitation, likely to install web shells.
- Reuters reported government websites in Europe and elsewhere went offline after disclosure.
- Cloudflare lists denial of service, remote code execution, and data exposure as impacts.
Scale
Censys counts about 2.58 million internet-facing PHP hosts and about 54.9 million PHP web properties. Platforms built on PHP include WordPress, Drupal, Joomla, and Magento. Wiz, Calif, and OpenAI were among those credited in discovery and coordinated disclosure.
What to Do
- Upgrade PHP to a fixed version for your branch, or apply your distribution's patched package.
- Update CMS platforms (WordPress, Drupal, Joomla, Magento) that ship their own PHP guidance or bundled runtimes.
- Enable WAF rules from your provider as a stopgap, not a substitute for patching.
- Hunt for unexpected web shells and recently modified PHP files on exposed hosts.