PHP emergency updates released for two critical remote code execution flaws
Developers issued fixes for CVE-2026-109618 and CVE-2026-109619 after authorities warned of active exploitation attempts.
Key points
- PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address two critical vulnerabilities allowing unauthenticated remote code execution.
- CERT-EU rated both flaws as 9.2 severity, prompting Finnish and Dutch government sites to go offline temporarily.
- watchTowr reported observing proof-of-concept exploits in the wild, though no successful breaches were confirmed at the time.
PHP developers released emergency security updates to address two critical vulnerabilities that allow unauthenticated remote code execution. The patches cover versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, responding to urgent warnings from cybersecurity authorities about immediate exploitation risks.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were rated 9.2 by CERT-EU in an advisory issued before the patches were available. The European cybersecurity body advised organizations to isolate internet-facing applications from public networks if immediate patching was not feasible, highlighting the severe potential for unauthorized access.
Active exploitation and government response
Security researchers have already observed attempts to exploit these flaws in real-world attacks. Jake Knott, head of threat intelligence at watchTowr, noted that sensors were detecting proof-of-concept code featuring "php2shell" user agents. While no successful intrusions were confirmed by watchTowr at the time of the report, the rapid appearance of exploits suggests persistent threat activity.
Several government entities took precautionary measures by taking their websites offline. According to The Register, Finnish government services and Dutch parliament sites were shut down temporarily. The Dutch cybersecurity authorities and data protection regulator also withdrew their online presence, alongside privacy campaign group noyb, to mitigate exposure while users updated.
Scope of affected installations
The developers stated that all PHP installations serving web requests are potentially affected. This includes deployments using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is considered highest for mod_php, where a demonstrated exploit can trigger an attack before any application code runs, bypassing standard application-level security checks.
Identifying all exposed systems is a substantial task for many organizations. Infosec vendor Huntress noted that PHP powers major platforms like WordPress, Drupal, Joomla, and Magento, as well as shared hosting platforms and control panels. Many applications do not advertise that they run PHP, making it difficult for administrators to know which servers require immediate attention.
What should you do?
Organizations running any version of PHP should apply the latest updates immediately. If systems cannot be patched right away, administrators should consider isolating them from public networks. Security teams should monitor logs for suspicious user agents or unusual request patterns that may indicate exploitation attempts.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: PHP
- Verify current PHP versions across all servers and apply the latest patches for 8.5, 8.4, 8.3, and 8.2 branches.
- Isolate internet-facing PHP applications from public networks if immediate patching is not possible.
- Monitor web server logs for unusual user agents or request patterns associated with proof-of-concept exploits.
- Review configurations for high-risk deployments such as mod_php to ensure additional protection layers are in place.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which PHP versions are affected by these new vulnerabilities?
Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address the flaws, meaning earlier versions of these branches are vulnerable.
Are there confirmed successful breaches using these vulnerabilities?
No successful breaches were confirmed by watchTowr at the time of the report, though exploitation attempts were observed.
What is the severity rating for CVE-2026-109618 and CVE-2026-109619?
CERT-EU listed both vulnerabilities with CVSS scores of 9.2, indicating critical severity.
