Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619: What You Need to Do Now

On 20 October 2026 the PHP security team gave advance notice of an urgent security release fixing two critical vulnerabilities. CERT-EU has identified them as CVE-2026-109618 and CVE-2026-109619, and the National Cyber Security Centre (NCSC) has issued an alert urging UK organisations to prepare to update PHP systems immediately.

PHP powers a large share of the web, including WordPress, Drupal, Magento, and Laravel applications, as well as many vendor appliances and management portals. A critical flaw in the language itself is likely to reach a very wide range of systems.

What We Know

• Both vulnerabilities are scored 9.2 under CVSS v4.0. CERT-EU notes the score indicates potential unauthenticated remote code execution, and security researchers have described both as remote code execution flaws.
• Code claiming to exploit the flaws is circulating. It has not been independently verified and may itself contain malware.
• Cloudflare reported early attacks against PHP sites on the morning of 21 October and has deployed emergency web application firewall (WAF) rules for all its customers, including free plans.
• CERT-EU warns the flaws could affect all PHP versions from PHP 5 onwards. This has not yet been confirmed by PHP.
• Fixes will only be issued for supported branches: PHP 8.2, 8.3, 8.4, and 8.5. PHP 8.1 and earlier are end of life and will not receive a fix.

PHP has not yet published technical details. Some reports cite a CVSS score of 10.0; the official PHP rating is 9.2.

What To Do Now

The NCSC advises organisations to:

Where a system cannot be updated promptly, the NCSC suggests taking it offline until it can be fully mitigated, and CERT-EU recommends isolating internet-facing applications from public networks. Configuration changes will not protect you, and WAF rules only cover traffic that passes through them.

When building your inventory, also check:

• Less obvious places PHP runs, such as container base images, CI/CD pipelines, staging environments, and developer machines.
• Managed or shared hosting. Ask your provider when they will deploy the update.
• Operating system packages. Patched builds from Linux distributions may arrive after the upstream release, so follow your distribution’s security notices.
• WordPress sites. The PHP version is shown under Tools, Site Health, Info, Server.
• Systems on PHP 8.1 or earlier. These need a branch upgrade, not a patch, and will stay exposed until they move to a supported version.
• Third-party package repositories. Builds from some repositories, such as Remi’s, are not expected to ship the fix on release day.

Why Speed Matters

Details are already public, attacks have been reported, and once fixes are released attackers can compare patched and unpatched code to refine their exploits. Mass exploitation is expected shortly after the release. Treat this as an emergency change rather than waiting for your normal patch cycle, and review internet-facing PHP systems for signs of compromise.

Sources

• PHP: Upcoming Critical PHP Security Release
• NCSC: Critical security issue affecting PHP
• CERT-EU: Security Advisory 2026-018, Critical Vulnerabilities in PHP
• Tenable: php2shell frequently asked questions
• PHP: Supported versions

Cover image: Markus Spiske, CC0, via Wikimedia Commons.