On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. Unlike vulnerabilities in individual PHP applications, these affect the underlying PHP runtime. This means applications built using PHP, including WordPress, Drupal, Laravel and custom PHP applications, may be exposed even when their application code is secure.

What are the CVEs?

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619

CVE-2026-109618: A memory corruption vulnerability caused by improper out-of-memory handling.

CVE-2026-109619: A use-after-free vulnerability involving stale internal state between PHP requests.

Which versions of PHP are affected

PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 and older	No official supported releases; vendor backports may be available

How bad is it?

It’s bad. Each has a CVSS v4.0 score of 9.2 out of 10. (Critical) To make it worse, the two PHP vulnerabilities were leaked before their planned public disclosure on 22 October 2026 prompting the PHP foundation to release the patches early. Package managers and system administrators are now scrambling to apply the fixes.

Several government organisations, universities, hospitals and private organisations temporarily took their websites offline on 21 October 2026 as a precaution before PHP’s official security fixes became available.

Exploits

The most concerning discovery. There may have been exploits before the leak! Amazon Threat Intelligence has reported identifying a PHP2Shell exploitation attempt dating back to 17 October 2026. Amazon detected the activity through its MadPot honeypot infrastructure. It also identified additional exploitation attempts during the early hours of 21 October. Amazon has not established how the attacker obtained the exploitation knowledge before public disclosure, or whether these attempts would have succeeded against real production systems - but it does mean the vulnerabilities may have been independently discovered or obtained by attackers before anyone publicly leaked their existence.

What now

Because these vulnerabilities can allow unauthenticated remote code execution, organisations should not treat this as an ordinary PHP maintenance update.

Server administrators should update PHP to a fixed version, verify that the patched runtime is actually running, and investigate suspicious activity dating back to at least October 17 2026.

For servers that cannot be patched immediately, restricting public access or temporarily taking affected services offline may be necessary. Configuration mitigations alone do not completely address these vulnerabilities.

Patch now without delay, verify the fix, and investigate possible exploitation.

The official PHP security advisory contains the exact mitigations and update instructions: PHP Security Advisory — 21 October 2026