Critical PHP Remote Code Execution Flaws Draw Early Attacks Across Millions of Exposed Web Hosts
PHP has released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSSv4.0 9.2 by the PHP security team and both described as exploitable by an unauthenticated remote attacker. The flaws affect essentially every installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the risk assessed as highest for mod_php. Patched releases arrived on 21 October 2026 as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the end-of-life 7.4 through 8.1 branches received no official release but did receive minimal source backports from the PHP security team, while 5.4 through 7.3 get nothing from the project. The scale of exposure is the headline concern: PHP is used by 69.3% of websites whose server-side language is known, and the platforms built on it include WordPress, Drupal, Joomla, Laravel and Magento. Public estimates of internet-facing exposure range from a rough figure of over 1.3 million potentially vulnerable hosts to a Shodan count of more than 1.9 million hosts running PHP.
The two bugs are distinct but reachable from the same place. CVE-2026-109618 stems from how PHP handles out-of-memory conditions: if memory is exhausted while PHP's internal request data is only partially initialised, the cleanup that follows can treat that partial data as valid, leading to memory corruption. CVE-2026-109619 is a use-after-free arising from stale global state, where leftover data from one request points at freed memory and a later request handled by the same worker process reuses it; PHP's advisory also lists memory disclosure as a confirmed impact of this second flaw. Under mod_php, a demonstrated exploit can be triggered by an unauthenticated request before any application code runs at all, meaning no plugin, theme or framework logic is required to reach the vulnerable path. A researcher-published exploit chain, dubbed php2shell, has been demonstrated on video and accompanied by a technical writeup; that writeup states the earliest affected code path identified dates back to PHP 5.4.0 and that pre-authentication remote code execution was confirmed against specific versions of WordPress, Drupal, Joomla and Magento. The CVE identifiers leaked on 20 October, prompting the release to be moved forward by a day; exploit code claiming to target these CVEs is circulating publicly but remains unverified, and the PHP security team said it did not identify any functional exploits at the time of disclosure.
A pre-authentication flaw in the runtime beneath two thirds of the web is close to a worst case for attack surface, because it bypasses the application layer entirely and ignores whatever hardening sits inside the CMS. Cloudflare's CTO has stated the company is seeing early attacks emerging and is updating mitigations as new vectors appear, and watchTowr says it has reproduced both vulnerabilities and is observing exploitation attempts against both — these are reported as attempts and emerging activity rather than confirmed compromises at this stage. History is not reassuring: earlier pre-auth PHP flaws were weaponised at speed and at scale, with CVE-2024-4577 added to CISA's Known Exploited Vulnerabilities catalogue on 12 June 2024 and known use in ransomware campaigns, carrying a 100.0% FIRST EPSS probability of exploitation in the next 30 days, and CVE-2019-11043 added to KEV on 25 March 2022, also linked to ransomware, at 99.7%. CVE-2012-1823, more than a decade old, still sits at 100.0% EPSS, showing how long opportunistic scanning for PHP execution bugs persists. The memory disclosure impact on CVE-2026-109619 adds a secondary concern, since leaked worker memory can contain session data, credentials and other request contents from unrelated users. Organisations running unsupported PHP branches are in the weakest position, as those lines receive only source-level backports or, below 7.4, nothing at all.
Attack Surface
Web Application, Content Management System, Server OS
Tactics
Initial Access, Execution, Persistence
Techniques
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter
- T1505.003 – Server Software Component: Web Shell
SuperPRO's Threat Countermeasures Procedures
- Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on branch – these are the fixed releases published on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, and the PHP security team states updating is the only complete fix.
- For end-of-life PHP 7.4.x through 8.1.x, apply the minimal source backports published by the PHP security team if you build from source, or track your Linux distribution or LTS vendor advisory, since distributions and LTS vendors received the patches in advance. PHP 5.4.x through 7.3.x receives no fix and should be moved to a supported branch.
- Where patching must be deferred, apply the vendor interim measure for CVE-2026-109618 by setting memory_limit=-1 in a way applications cannot override, and restart every PHP worker afterwards. PHP states this reduces exposure to specific attack paths but does not make the installation safe.
- Where patching must be deferred, apply the vendor interim measures for CVE-2026-109619 by setting session.upload_progress.enabled=0, and additionally fatal_error_backtraces=0 on PHP 8.5, then restart every PHP worker.
- Inventory all PHP execution modes in the estate – PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed – and remediate mod_php hosts first, as PHP rates these highest risk because a demonstrated exploit fires on an unauthenticated request before application code runs.
- Enable the Cloudflare WAF rules deployed for the known exploit vectors of these two CVEs on PHP sites behind Cloudflare – the ruleset is available on all plans including free – and treat it strictly as a stopgap until the fixed PHP version is in place.
- Hunt compromised web estates for post-exploitation artefacts: new or modified .php files in the document root, and unexpected child processes spawned by php-fpm, httpd or litespeed workers. Do not execute the unverified proof-of-concept code circulating publicly for these CVEs, as such code is sometimes laced with malware.
