PHP Foundation Releases Emergency Patches for Two Critical Remote Control Flaws

The PHP Foundation released emergency security updates on Wednesday to address two critical vulnerabilities that allow attackers to gain remote control of victim systems. The developers issued patches for PHP 8.2 and newer versions, warning that these flaws pose a severe risk to millions of websites relying on the scripting language.

The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619. According to the PHP Foundation, these issues impact all PHP installations serving web requests, tracing back to PHP version 5 released in July 2004. However, only PHP 8.2 and newer are currently supported and will receive official patches from the foundation.

Scope and Impact

The PHP Foundation stated that there are no complete mitigations and that updating is the only safe choice. Security experts warn that failing to patch these systems quickly could lead to dire consequences. Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, described the situation as urgent.

Olejnik noted that PHP has evolved into essential infrastructure for web development since the 1990s. He warned that the impact is enormous, with millions of systems potentially affected. The worst-case scenario involves wormable malware spreading rapidly across large sections of the internet if attackers exploit these vulnerabilities quickly.

Who Is Affected

The vulnerabilities affect a wide range of web applications built on PHP. This includes publishing systems such as WordPress and Drupal, as well as e-commerce platforms like Adobe’s Magento. Because PHP is foundational to much of the web, these flaws touch vast swaths of internet infrastructure.

While the PHP Foundation only supports PHP 8.2 and newer, it noted that some distributions and third-party vendors still produce legacy fixes for older versions. This caveat is significant because older PHP installations often persist in historic internet infrastructure, remaining forgotten and un-updated for years.

What should you do?

Internet infrastructure company Cloudflare reported seeing early attacks emerging before the PHP Foundation detailed the vulnerabilities and released fixes. Security firm Sansec predicted that mass attacks would begin within 15 minutes of the patch release. The updates were released just before 10 am ET on Wednesday, prompting security teams to scramble for deployment.

What to do and how to stay safe: PHP

• Identify all servers and containers running PHP 8.2 or newer and prioritize applying the latest security patches immediately.
• Contact your hosting provider or distribution vendor to determine if legacy fixes are available for unsupported PHP versions.
• Monitor network traffic and web server logs for unusual activity or signs of exploitation attempts in the hours following the patch release.
• Review access controls and limit exposure of PHP-enabled endpoints to reduce the attack surface while updates are being deployed.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

The vulnerabilities impact all PHP installations serving web requests, including versions going back to PHP 5 released in July 2004.

Are patches available for PHP versions older than 8.2?

The PHP Foundation only provides official patches for PHP 8.2 and newer, but some third-party vendors may offer legacy fixes.

Is there any mitigation other than updating?

No, the PHP Foundation stated that there are no complete mitigations and that updating is the only safe choice.