Short answer: On Oct 21, the PHP project released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The advisory says they can allow unauthenticated remote code execution. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart all PHP workers. PHP 8.1 and older get no official release, only source patches for 7.4, 8.0 and 8.1, so ask your distribution or LTS vendor. The PHP advisory says updating is the only complete fix. Public reports so far describe a working proof of concept and “early attacks,” but not confirmed widespread exploitation.
What are the two flaws?
According to the PHP advisory:
| CVE | What goes wrong |
|---|---|
| CVE-2026-109618 | If PHP runs out of memory, it can be interrupted while request data is only partly set up. Cleanup may then treat invalid data as valid, leading to code execution |
| CVE-2026-109619 | Request state can outlive the memory it points to. A later request on the same worker may use that stale state before it is reset |
The advisory says every PHP installation serving web requests could be exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php carries the highest risk. For definitions of the terms used, see what is a CVE.
Which versions are fixed?
Google Cloud, quoted by TechRepublic, says PHP 5.4 through 8.5.11 are affected. Treat the exact lower bound as approximate: Sansec gives the same figure, while claims that it goes back to 2004 come from social media posts.
How many servers are on old versions?
Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older, 59% of about 1.5 million showing a version, as reported by Decrypt. Shared hosting means more sites sit behind each host. The same article notes the widely shared “70% of the internet” line overstates a W3Techs figure, which is about sites whose server-side language is known.
Who took sites offline?
TechRepublic reports precautionary shutdowns. The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline temporarily and said it saw no indications of active exploitation at the time. Germany’s federal IT provider suspended several websites, French prefecture sites went offline, and Finland’s state IT center shut public web services. The shutdowns were precautionary, not evidence of a breach.
Is it being exploited?
- Proof of concept: The PHP Foundation said a demonstrated exploit works before any application code runs on mod_php servers (via Decrypt).
- Early attacks: Cloudflare’s CTO reported early attacks and said its WAF rules are a stopgap only (via Decrypt).
- Predictions: Sansec expected mass attacks soon after release. That is a forecast, not an observation.
- Unconfirmed: Neither source confirms how many sites were compromised.
Who found the bugs?
OpenAI says it led a two-month coalition effort called Patch the Planet, that a group named Calif identified a critical flaw using GPT-5.6 Sol, and that Wiz independently found and reported both bugs. OpenAI also says it released a PHP version checker as a Codex skill. These are OpenAI’s claims. For another AI-assisted bug-finding program, see Anthropic OSS Scanner.
What should I do today?
- Find where PHP runs: servers, containers, hosting panels and cloud runtimes.
- Update to a fixed version. Custom runtimes on Google Cloud, some Cloud Run deployments and GKE may need a rebuild and redeploy, per TechRepublic.
- Restart all workers such as Apache and PHP-FPM, and confirm the patched runtime is serving traffic.
- If you cannot update yet, isolate internet-facing apps. The advisory lists mitigations such as disabling
session.upload_progress.enabled, but says they reduce exposure only. - Check logs for the exposure period. NCC Group’s Matt Hull warns patching does not prove a system is clean.
What about WordPress?
Wordfence, cited by Decrypt, says every WordPress site runs on a PHP server and that automatic WordPress updates will not apply this fix. Site owners need to find out who updates PHP on their server, which on shared hosting is often the host.
What I am unsure about
- How many sites have actually been compromised. No source I found gives a number.
- The lowest affected PHP version. Sources give approximate ranges.
- The BBC and some other reports were not available to me, so shutdown details come from TechRepublic.
- I have not tested the exploit or the patches.
FAQ
Do I need to update if I only run PHP behind PHP-FPM?
The advisory lists PHP-FPM as at risk, with mod_php the highest risk. Update either way.
Is PHP 8.1 safe if I cannot upgrade?
No official release exists. Use your vendor’s backport or the source patches and plan an upgrade. PHP 8.2 reaches end of life on Dec 31, 2026, per Decrypt.
Can a WAF protect me?
It may reduce exposure. Cloudflare calls its rules a stopgap only, and the PHP advisory says updating is the only complete fix.
Sources
- PHP security advisory, Oct 21 — php.net
- Critical PHP flaws and EU website outages — TechRepublic
- PHP panic: critical bugs and the 70% claim — Decrypt
- Patch the Planet — OpenAI
Written with AI assistance and checked against the sources above. See About for how ossbeat works.
