PHP Developers Rush to Patch Critical Vulnerabilities

"We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs," the project's developers said.

CVE-2026-109618 and CVE-2026-109619: two critical, unauthenticated RCEs

PHP's maintainers released emergency fixes on Oct. 21 for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The vulnerabilities were given CVSS scores of 9.2 by CERT-EU, which issued an advisory ahead of the patches and urged urgent mitigation.

Emergency patches published: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35

Developers published updates for four supported PHP release lines — 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — and urged users to update immediately. The project's guidance noted that "all PHP installations serving web requests are potentially affected," explicitly naming deployments that include PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The project's warning singled out mod_php as the highest risk configuration because of a demonstrated exploit path that can be triggered by an unauthenticated request before any application code executes.

Observed exploit activity and public PoCs

Threat intelligence firms reported active scanning and proof-of-concept activity. Jake Knott, head of threat intelligence at watchTowr, said: "As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of vibecoded PoCs already hitting our sensors featuring a variety of 'php2shell' User-Agents. Whilst nobody has been successful to date, we don't expect that will last long."

That combination — in-the-wild probes and public PoCs — was the exact reason CERT-EU urged immediate mitigations and, where patching could not be performed quickly, recommended isolating internet-facing applications from public networks until a fix was available.

Immediate operational responses: governments and privacy groups

Several public-sector and civil-society operators took precautionary action. Finnish government services were taken offline, and websites belonging to the Dutch parliament, Dutch cybersecurity authorities, and the Dutch data protection regulator were also taken down as a preventive measure. Privacy campaign group noyb temporarily withdrew its website.

How technologists, regulators, and hosting providers are likely to react

• Technologists and security teams: expect rapid prioritization of the four patched PHP release lines and focused audits of web-facing PHP instances. Huntress highlighted the breadth of exposure, noting PHP "powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood."
• Regulators and government operators: some already took services offline as a precaution; CERT-EU's advisory and the demonstrated exploitability for mod_php create a clear impetus for urgent mitigations across public-sector infrastructure.
• Hosting providers and site operators: the scale of discovery work will be large. John Hammond, Huntress's senior principal security researcher, said: "The number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast."

The immediate facts are straightforward: emergency patches are available for four PHP release lines; public advisories with high severity scores have gone out; exploit probes and PoCs are already observed; and some governments and organizations have taken sites offline as a precaution. The developers' blunt instruction — update immediately — is matched by CERT-EU's recommendation to isolate internet-facing applications when patching is not immediately feasible. For any team running web-facing PHP today, the next step is binary: apply the published updates or follow the isolation guidance until they can.

Original story: The Register — PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched