PHP Releases Emergency Patches for Two Critical Flaws That Let Attackers Run Code on Web Servers

CYBER — The PHP project shipped emergency updates on October 21, 2026, that fix two critical security flaws. These flaws can let an attacker run code on a web server that uses PHP, without needing a login or any credentials.

The updates cover the currently supported versions of PHP. The Cybersecurity and Infrastructure Security Agency (CISA) issued an alert the same day urging organizations to apply the patches immediately and stated it had not observed any exploitation as of the time of publication.

The two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 on the standard severity scale for software vulnerabilities. They affect every PHP installation that serves web requests, including the common setups used with Apache, PHP-FPM, and other web servers.

The risk is highest for Apache servers running the mod_php module, where researchers showed that a simple unauthenticated web request can trigger the problem before any website code even starts running. No threat group has claimed responsibility, and CISA has not linked the flaws to any specific attacker.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older unsupported branches (PHP 8.1 and earlier) do not receive official updates from the PHP project, though limited source-level fixes were provided for some of them.

Linux distributions and long-term support vendors received the patches ahead of the public release so they could prepare their own packages.

Incident Parameters

• Attack Vector: unauthenticated web request that exploits a memory-handling flaw inside PHP itself (MITRE ATT&CK T1190 Exploit Public-Facing Application)

• CVE: CVE-2026-109618 (CVSS 9.2 v4.0, PHP Group), affects PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, 8.5.x before 8.5.12; CVE-2026-109619 (CVSS 9.2 v4.0, PHP Group), same affected ranges

• Threat Actor: attribution unknown, no group has claimed responsibility

• Affected Systems: PHP installations serving web requests on supported branches before the fixed versions, plus end-of-life branches 8.1 and earlier

• MITRE ATT&CK TTPs: T1190 Exploit Public-Facing Application (observed in researcher demonstrations against mod_php; assessed for real-world use)

• Timeline: advance notice October 20, 2026; patches and advisories released October 21, 2026 (announced for 2:00 PM UTC); CISA alert October 21, 2026

• CISA KEV Status: not listed; CISA stated it has not observed exploitation as of the time of publication

• TLP Designation: TLP:CLEAR

• Affected Sectors: any organization running internet-facing or internal PHP web applications, spanning multiple of the 16 CISA critical infrastructure sectors

• Geographic Scope: global, any PHP installation serving web requests

Official Statements

• PHP Security Team, October 21, 2026: “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.”

• CISA, October 21, 2026: “While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.”

• PHP Security Team, October 21, 2026: “There are no complete mitigations, updating is the only safe choice.”