PHP patches released for critical CVE-2026-109618 and CVE-2026-109619

The PHP maintainers released urgent patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, following the detection of active exploitation attempts. Security teams are advised to verify their environments immediately, as the flaws affect a vast portion of the web and have prompted widespread service disruptions.

What happened

PHP maintainers issued an urgent notice regarding two new bugs, CVE-2026-109618 and CVE-2026-109619, which carry severity scores of 9.2 out of 10. According to The Record, the PHP security team rated these vulnerabilities as critical and urged all users to prepare for immediate upgrades. The advisory explicitly stated that PHP 8.1 and older versions no longer receive updates from the project, leaving those installations without vendor support.

Dozens of government agencies released warnings throughout the evening and early Wednesday morning, instructing website maintainers to patch systems now that fixes are available. The European Union, Germany, Japan, Australia, the U.K., and the Netherlands all issued local warnings. Some governments proactively took websites offline before the patches were released to mitigate risk.

Large organizations, including Nintendo, also took services offline to address the bugs, which have been dubbed “PHP2Shell.” Dane Knecht, CTO of Cloudflare, stated that the company is already seeing emerging attacks. Cloudflare released stopgap mitigations to help protect some customers against the exploitation attempts observed in the wild.

Jake Knott, head of threat intelligence for watchTowr, reported observing in-the-wild exploitation of these vulnerabilities. He noted that attackers are using a variety of proof-of-concept tools that appear to be vibecoded with the help of AI. Knott stated that while no successful compromises have been confirmed to date, he does not expect that status to last long.

Why it matters

Experts estimate that more than 70% of all websites on the internet use PHP, making the exposure surface exceptionally large. WatchTowr experts noted that enterprise networks commonly run PHP-based content management systems and internal tools. These servers often handle sensitive customer data and business logic that is directly reachable from the internet, increasing the potential impact.

Security researchers expressed deep concern that millions of PHP-backed websites are still running ancient versions of the language. Joviane Jardim, a senior security researcher at Detectify, stated that many organizations only learn about forgotten PHP servers when an attacker finds them. The inability to update older versions leaves many legacy systems permanently vulnerable to these specific flaws.

Our take on the response

• Prioritize patching for all supported PHP versions immediately upon release.
• Identify and isolate unsupported PHP 8.1 and older instances in the environment.
• Monitor for traffic patterns consistent with proof-of-concept exploitation tools.

What defenders should look for

Security teams should review web server access logs for unusual request patterns or spikes in error rates that may indicate scanning activity. Analysts typically check for signs of unauthorized code execution or unexpected outbound connections from web servers. Defenders often monitor for the use of known proof-of-concept tools in traffic captures. Initial containment moves usually involve isolating affected web servers from the network and blocking suspicious source IPs at the perimeter firewall.

What to do and how to stay safe: PHP

• Inventory all systems running PHP to identify versions that are no longer supported, such as 8.1 and older.
• Apply the latest security patches for supported PHP versions as soon as they are available.
• Monitor web application logs for signs of exploitation attempts or unusual traffic patterns.
• Consider taking vulnerable, unsupported services offline until a secure migration plan is executed.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE IDs are associated with these PHP vulnerabilities?

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.

Are there patches available for PHP 8.1 and older versions?

No, PHP 8.1 and older versions no longer receive updates from the PHP project.

What severity score have these vulnerabilities received?

Both vulnerabilities carry severity scores of 9.2 out of 10 and are rated critical.