Two critical PHP vulnerabilities have triggered an emergency patching alert as security researchers report early attack activity. Administrators must identify exposed systems before the scheduled fixes arrive.
The PHP security team scheduled patches for October 21, 2026, at 14:00 UTC (10 a.m. Eastern). Both flaws carry Common Vulnerability Scoring System (CVSS) v4.0 ratings of 9.2. Researchers warn of potential remote code execution (RCE), although PHP has not confirmed the attack mechanics or affected versions.
Organizations running PHP-powered websites, e-commerce platforms, and custom applications must identify potentially vulnerable runtimes and coordinate patching. Unsupported installations pose additional challenges because they will not receive normal upstream security updates.
Two critical PHP flaws and emerging attacks
In its October 20 security announcement, PHP urged administrators to prepare for immediate upgrades. The team also said fixes could arrive earlier if technical details became public or evidence of active exploitation emerged.
CERT-EU identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619. Researchers suggest PHP versions dating back to PHP 5 could be affected, but the official scope remains unconfirmed. Successful exploitation could potentially allow unauthenticated attackers to execute code on vulnerable servers.
Security firm watchTowr told BleepingComputer that it believed it had reproduced CVE-2026-109618. Tenable subsequently reported that Cloudflare was observing early attacks, although the extent of successful compromises remains unknown.
The reported vulnerabilities involve PHP itself rather than a third-party application plugin. A recent Bricksforge WordPress vulnerability also exposed PHP-powered websites to code execution, but updating application components alone would not necessarily fix an affected PHP installation.
Preparing PHP systems for emergency fixes
Administrators should prepare to install verified PHP security patches as soon as they become available. PHP's supported-version policy covers branches 8.2 through 8.5. Older releases lack upstream support, although vendors may provide backported fixes.
Security teams should prioritize six measures:
- Identify exposed PHP systems. Inventory internet-facing applications, servers, containers, and hosting environments. Verify production runtimes rather than relying solely on command-line version checks.
- Prepare and verify updates. Coordinate patching, check backups, test compatibility, and rebuild affected containers. Recent NGINX security fixes reinforce the need to verify installed versions and configurations.
- Restrict access and privileges. Isolate vulnerable workloads, enforce least-privilege permissions, and limit unnecessary external connections.
- Strengthen temporary defenses. Review WAF and hosting-provider protections. Cloudflare's October 21 emergency WAF update added four managed rules for anomalous requests: two blocking and two logging rules. Cloudflare did not identify the PHP CVEs in that announcement, and these controls cannot replace patching. The recent SiteGuard WAF vulnerability also underscores the need to maintain defensive infrastructure.
- Monitor potential compromise. Investigate suspicious HTTP requests, unexpected server processes, and unauthorized file changes. Preserve evidence and assess potentially exposed credentials.
- Test incident response plans. Verify containment procedures, escalation contacts, and backup restoration. Conduct exercises covering server isolation and recovery.
Managed hosting customers should confirm patch schedules with their providers. CloudLinux's package advisory notes that updated hosting packages depend on upstream PHP fixes.
Unsupported PHP installations require vendor backports, migration, or continued exposure restrictions. Verified runtime updates remain the primary remediation.
Read more: Recent Ivanti VPN zero-day attacks show why patching must be accompanied by investigations into possible credential theft and unauthorized access.