Cloudflare deploys firewall rules as PHP patches critical RCE flaws after exploit leak
The PHP project releases urgent fixes for two critical vulnerabilities rated 9.2 on the CVSS scale after exploit code leaked and early attacks were detected.
Key points
- PHP releases emergency patches for CVE-2026-109618 and CVE-2026-109619 on Wednesday.
- Both flaws are rated 9.2 on the CVSS v4.0 scale and allow remote code execution.
- Cloudflare reports early attacks and has deployed stopgap firewall rules for customers.
The PHP project released an unscheduled security update on Wednesday to address two critical vulnerabilities that allow remote code execution. The patches fix flaws catalogued as CVE-2026-109618 and CVE-2026-109619, which researchers have dubbed “php2shell.” The release was moved up from its original Thursday schedule after details leaked online and a major infrastructure provider reported early exploitation attempts.
Both vulnerabilities are rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. According to CyberScoop, these flaws could let attackers run arbitrary code on servers and potentially take control of them. The PHP team stated that full technical details and a complete list of affected versions would be published alongside the release, though CERT-EU indicated the flaws might impact every PHP version from 5 onward.
View the original post on X
View the original post on X
Context and Background
The security firm watchTowr noted that the vulnerabilities were originally set for release under embargo on Thursday. The PHP team accelerated the timeline to Wednesday at 10 a.m. EDT, stating it could act sooner if exploitation increased. A video demonstrating an exploit chain spread online overnight, shared by researcher Kirill Firsov, who credited researchers LCFR and Calif.io. watchTowr confirmed it had reproduced one of the flaws.
Unverified exploit code is circulating online, but security firms caution that such code is sometimes laced with malware. The PHP team has not officially confirmed the technical cause or a definitive list of affected versions, leaving administrators to rely on the emergency patch. The rapid release reflects the urgency of the situation, with the project aiming to mitigate risk before widespread automated attacks occur.
Who Is Affected
The potential exposure is broad, as PHP runs between 70% and 80% of websites with a known server-side language, according to market research. The language underpins major platforms including WordPress, Drupal, Joomla, and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, while a Shodan search counted approximately 1.9 million.
Among servers that disclose their version, most run branches no longer receiving security updates. VirusTotal data shows about 758,000 servers run versions from 5.4 through 8.1, compared with 272,000 on supported branches. Dane Knecht, chief technology officer at Cloudflare, said the company is seeing early attacks emerging and has deployed firewall rules covering known exploit vectors to all customers, including free accounts, as a stopgap measure.
What should you do?
System administrators should apply the emergency PHP update immediately to mitigate the risk of remote code execution. Hosting providers need to ensure all customer environments are patched, especially those running older, unsupported versions of PHP. Organizations should monitor logs for unusual activity, as unverified exploit code is circulating and may contain malware.
What to do and how to stay safe: PHP
- Apply the emergency PHP update provided by the vendor to all production servers immediately.
- Audit server logs for signs of unauthorized code execution or unusual outbound connections.
- Verify that web application firewalls are updated with the latest rules to block known exploit vectors.
- Monitor official PHP security advisories for additional details on affected versions and mitigation steps.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the new PHP vulnerabilities?
The vulnerabilities are catalogued as CVE-2026-109618 and CVE-2026-109619.
How severe are these PHP flaws?
Both flaws are rated 9.2 on the CVSS v4.0 severity scale, which is considered critical.
Which PHP versions are affected by these vulnerabilities?
CERT-EU says the flaws could affect every version of PHP from 5 onward, though the PHP team will confirm the full list with the release.
