Emergency PHP patches issued for critical remote code execution flaws

CERT-EU warns organisations to isolate internet-facing applications if patching is not immediately possible

By LineZotpaper

Published21 October 2026

Updated21 October 2026

Read Time2 min

Sources6 outlets

PHP developers have released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. Cybersecurity authorities and industry experts are urging immediate patching, with threat intelligence firm watchTowr reporting it is already observing in-the-wild exploitation attempts.

The PHP project has issued patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address the two vulnerabilities, both carrying a CVSS severity score of 9.2. The flaws affect all PHP installations serving web requests, including deployments using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Developers indicated that the highest risk is for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs.

Security vendor CERT-EU issued an advisory ahead of the patches, recommending that organisations isolate internet-facing applications from public networks if immediate patching is not feasible.

Jake Knott, head of threat intelligence at watchTowr, reported that the company's sensors are already detecting exploitation attempts in the wild, featuring various "php2shell" User-Agents. Knott noted that while no successful compromises have been observed so far, he expects that to change.

Several organisations took precautionary measures by taking websites offline, including Finnish government services, Dutch parliamentary websites, and sites belonging to cybersecurity authorities and data protection regulators. Privacy campaign group noyb also temporarily withdrew its website.

The widespread use of PHP in content management systems such as WordPress, Drupal, Joomla, and Magento, as well as shared hosting platforms and control panels, means identifying and patching all exposed installations is a significant challenge. John Hammond, senior principal security researcher at Huntress, noted that the number of places to search for vulnerable PHP versions becomes very large very quickly.

Analysis

Why This Matters

The vulnerabilities allow remote code execution without authentication, giving attackers full control over affected servers.
PHP powers a vast percentage of web infrastructure, including major CMS platforms, shared hosting, and many applications that do not publicly advertise their use of PHP.
Active exploitation attempts are already being detected, meaning the window for patching before widespread attacks occur is narrow.

Background

PHP is a widely-used server-side scripting language that underlies many of the world's websites, including those built on WordPress, Drupal, Joomla, and Magento. Vulnerabilities in PHP can have cascading effects across the internet, as the language is also embedded in shared hosting platforms and control panels that may not be immediately visible to administrators. CERT-EU, the computer emergency response team for the European Union, regularly issues advisories for critical vulnerabilities; its pre-patch advisory for these flaws underscores the severity of the risk.

Key Perspectives

PHP project developers: Have released emergency patches and urge all users to update immediately, highlighting the highest risk for mod_php deployments. CERT-EU and cybersecurity authorities: Advise isolation of internet-facing applications from public networks when patching is not immediately feasible, and have taken their own websites offline as a precaution. Security researchers (watchTowr, Huntress): Confirm exploitation attempts are already underway, expect successful compromises soon, and warn that identifying all vulnerable installations is a substantial challenge due to PHP's pervasive use.

What to Watch

Speed of patch adoption across hosting providers and large organisations.
Arrival of reliable public exploits, which could trigger widespread automated attacks.
Reports of successful compromises and any resulting data breaches or website defacements.

Sources

PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out · Decrypt
Australia’s cybersecurity site among those hit by ‘critical’ software flaw · Latest Science news
Australia’s cybersecurity site among those hit by ‘critical’ software flaw · Just In
Widespread PHP Flaw May Cause Many Site Outages Today · Krebs on Security
PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched · www.theregister.com - Articles
PHP developers say key patches available after global scare · DW English

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedEmergency patches have been issued for critical remote-code-execution flaws.www.theregister.com - Articles: “PHP developers have released emergency updates for two critical vulnerabilities”
SupportedCERT-EU advises isolating internet-facing applications if immediate patching is not feasible.www.theregister.com - Articles: “Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available," CERT-EU said”
SupportedThe two named vulnerabilities can allow unauthenticated remote code execution.www.theregister.com - Articles: “PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution.”
Partly supportedCybersecurity authorities and industry experts are urging immediate patching.www.theregister.com - Articles: “after cybersecurity authorities warned organizations to patch immediately”
SupportedThe PHP project issued patches in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.www.theregister.com - Articles: “PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and CVE-2026-109619.”
SupportedBoth vulnerabilities carry a CVSS score of 9.2.www.theregister.com - Articles: “The body lists both vulnerabilities with CVSS scores of 9.2.”
Partly supportedAll PHP installations serving web requests are affected.www.theregister.com - Articles: “All PHP installations serving web requests are potentially affected, including deployments using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed, the developers said.”
SupportedThe developers identify mod_php as the highest-risk deployment, with an exploit triggerable by an unauthenticated request before application code runs.www.theregister.com - Articles: “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”
SupportedwatchTowr is observing in-the-wild exploitation attempts featuring “php2shell” User-Agents.www.theregister.com - Articles: “watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities, with a variety of vibecoded PoCs already hitting our sensors featuring a variety of 'php2shell' User-Agents.”
SupportedKnott said no successful exploitation had been observed so far, but he expected that to change.www.theregister.com - Articles: “Whilst nobody has been successful to date, we don't expect that will last long.”
SupportedFinnish government services, Dutch parliamentary websites, cybersecurity authorities’ websites and a data-protection regulator’s website were taken offline as a precaution; noyb also temporarily withdrew its website.www.theregister.com - Articles: “Finnish government services and websites belonging to the Dutch parliament, cybersecurity authorities, and data protection regulator were taken offline as a precaution. Privacy campaign group noyb also temporarily withdrew its website.”
Partly supportedPHP’s use across content-management systems and hosting platforms makes identifying and patching all exposed installations a significant challenge.www.theregister.com - Articles: “PHP "powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn't even advertise that it runs PHP under the hood," infosec vendor Huntress noted. That makes identifying exposed installations a substantial job.”