PHP patches critical flaws as millions of websites face immediate exploitation risk
Urgent updates address severe remote code execution bugs after early exploitation attempts were detected by security researchers.
Key points
- PHP released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- Both flaws carry a CVSS score of 9.2, classified as critical severity.
- Security firms reported active exploitation attempts before the fixes were publicly available.
Organisations using PHP must apply emergency updates immediately to address two critical remote code execution vulnerabilities that are already being exploited in the wild. The PHP project has strongly encouraged all users to patch their systems without delay.
What we know
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involve an out-of-memory handling bug and a use-after-free memory error respectively. Both were assigned a severity score of 9.2 out of 10. According to the PHP security advisory, these issues have been resolved in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can obtain these versions directly from the official PHP downloads page, where Windows source code and binaries are located. Linux distributions and long-term support vendors received the patches in advance, meaning users on these platforms should check with their specific providers for updated packages rather than downloading directly from the main site.
Security researchers and Cloudflare reported early exploitation attempts before the patches became publicly available. This rapid abuse has caused significant concern across the industry. Information about the vulnerabilities leaked onto the internet two days before the official release, leading to panic. According to Reuters, multiple government, healthcare, and education websites across Europe temporarily shut down to prevent being targeted during this window.
While some early reports suggested a perfect severity score or broader version coverage, the final advisory confirmed the 9.2 score and limited patching to PHP 8 series versions. This distinction is crucial because millions of websites still run older, end-of-life versions of PHP that will not receive these fixes. Data cited by BleepingComputer indicates that more than 5.1 million PHP hosts are currently exposed online, with approximately 3.8 million having at least one port open. This leaves a vast number of legacy installations vulnerable to relative ease of attack.
Defender's checklist
- Verify your current PHP version against the list of patched releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Contact your Linux distribution or hosting vendor to confirm they have distributed the updated packages.
- Monitor server logs for unusual activity or signs of exploitation that may have occurred prior to patching.
- Identify any systems running unsupported PHP versions and plan for migration or isolation from the internet.
The background in plain language
Remote code execution flaws allow attackers to run arbitrary commands on a server without prior access. This typically results in full system control. Use-after-free errors occur when code accesses memory that has already been freed, leading to unpredictable behaviour. Out-of-memory bugs arise when a system fails to handle resource exhaustion correctly. Teams usually monitor for these issues by tracking vendor advisories and security alerts. Check whether your environment is exposed by reviewing open ports and software versions regularly.
What to do and how to stay safe: PHP
- Check your server logs for suspicious connections or failed authentication attempts that may indicate prior exploitation.
- Ensure your web applications are running one of the patched PHP versions listed in the advisory.
- Restrict access to PHP-enabled servers by closing unnecessary ports and using firewalls to limit exposure.
- Once the vendor provides an update, apply it immediately to all internet-facing systems running compatible versions.
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these vulnerabilities?
The patches address vulnerabilities in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but older unsupported versions remain at risk.
What is the severity of these flaws?
Both CVE-2026-109618 and CVE-2026-109619 have been assigned a critical severity score of 9.2 out of 10.
Are Linux users already protected?
Linux distributions and LTS vendors received the patches in advance, so users should check with their specific providers for updates.
