Brief · Builders

Critical PHP Security Release: Patch, Rebuild, Skip the PoCs

By alkizz · Oct 21, 2026

You'd think the whole internet broke at 10 AM ET. It didn't. W3Techs says PHP is used by 69.3% of websites whose server-side language it can detect. That's most of the web, not the internet, and running PHP isn't the same as being exploitable.

What's confirmed: PHP's Oct 21 release fixes CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state). Each is CVSS v4.0 9.2, with high attack complexity, and gives unauthenticated code execution as the web worker. PHP says any install serving web requests is at risk: FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed. mod_php is worst, because the demonstrated exploit fires before any app code runs.

Confirmed: threat actors are already trying. Cloudflare says it "observed attack traffic targeting our customers" and saw attackers "mutating the attack payload" to get past its protections. watchTowr told The Record it is seeing exploitation attempts in the wild, some using PoC tools built with AI's help, and that "nobody has been successful to date." Precursor Security reports attempts against both CVEs. No successful compromise is confirmed, and neither CVE is in CISA's KEV catalog as of the Oct 21, 2026 feed (catalogVersion 2026.10.21), re-checked about 12:45 PM ET. Sansec says writeups and an exploit tool are public and expects mass exploitation. Don't wait for the first confirmed breach. Patch now. A researcher's pre-release demo, which Huntress says was posted and then pulled, still isn't tied to these CVEs by PHP.

Before release, the gap filled with unverified PoCs; at least one author said AI models helped write theirs. Now watchTowr says AI-vibecoded PoC tools are being fired at real servers. None has worked yet, according to watchTowr.

The irony: AI helped with the real bugs too. Researchers at Calif, Wiz and OpenAI found and weaponized the bugs with help from frontier AI models; Sansec says all three credit frontier models with making the exploits practical. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol; Calif says no special harness or models that weren't generally available were used in the initial discovery, and that knowing the target drove the find.

A random PoC may be fake, hit a different bug, or be malware aimed at people who run random PoCs. The config "mitigation" some traced to a chatbot answer, turning off session upload progress, was partly right: PHP now lists it as a mitigation for the session paths of CVE-2026-109619 only, not a fix. A fluent guess can be partly right, which is exactly why it's a hint and not a fix.

What to do:

• Now:
  • Inventory PHP: servers, images, managed hosts, appliances, WordPress-type stacks, and anything an agent deployed. Note who patches each and its SAPI. Do mod_php first.
  • If you can't patch right away, isolate internet-facing PHP apps from public networks until you can, as CERT-EU advises.
  • If your PHP site is proxied through Cloudflare (orange cloud), Cloudflare's CTO says it has "an initial set of WAF rules deployed for the known exploit vectors" on all plans, including free. He also calls it "a STOPGAP only": it buys time until you patch.
• Patch:
  • Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • 8.1 or older gets no official release. PHP posted source-only backports for 7.4, 8.0 and 8.1; the real fix is a supported branch.
  • PHP says the Remi repo (rpms.remirepo.net) won't have updates today; switch to distro packages or build from source.
  • Restart every PHP worker, rebuild images, and confirm the version your web server actually runs (e.g. php-fpm -v or a non-public phpinfo() page), not just php -v. Managed hosts included.
  • Can't patch yet? session.upload_progress.enabled=0 in php.ini or the FPM pool (not ini_set or .user.ini), then restart workers. Partial: PHP says it blocks only the confirmed session paths, not other variants.
• Don't run random PoCs, on prod or on a laptop with credentials. Use PHP's advisory.
• Treat LLM-written rules and analysis as hints, not proof.
• Incident response:
  • Preserve web server, proxy, WAF and PHP logs from Oct 20 onward, off-host, before rotating anything. Snapshot suspicious hosts before patching. Note each host's PHP version and patch time.
  • Hunt for odd multipart requests followed by memory-limit errors or repeated 500s, malformed PHPSESSID cookies, unexplained worker restarts and new .php files. A quiet log isn't proof you're clean.
  • If anything looks off, rotate session tokens and secrets the PHP user could read. Researchers report memory disclosure.

It's real and worth patching today. It's also a patch, not the end of the internet. Update, rebuild, keep the logs, go back to work.

Sources

• W3Techs: Usage statistics of PHP for websites (Oct 21, 2026)
• PHP: security release advisory for CVE-2026-109618 and CVE-2026-109619 (news archive, Oct 21, 2026)
• PHP advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• PHP advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• php-src: PHP 7.4 source-only backport branch
• php-src: PHP 8.0 source-only backport branch
• php-src: PHP 8.1 source-only backport branch
• Sansec: PHP2Shell (Oct 21, 2026)
• Wiz: PHP2Shell
• Calif: PHP2Shell
• Cloudflare CTO on X: initial WAF rules, "a STOPGAP only" (Oct 21, 2026)
• Cloudflare blog: PHP vulnerabilities and WAF protection (Oct 21, 2026)
• The Record: warnings on the PHP vulnerabilities, with watchTowr (Oct 21, 2026)
• Precursor Security: PHP2Shell live blog (Oct 21, 2026)
• Huntress blog on the leaked critical PHP vulnerabilities (Oct 21, 2026)
• X: a PoC author on using Grok, DeepSeek and Nemotron (Oct 21, 2026)
• X: StopForumSpam on a chatbot-suggested upload_progress mitigation (Oct 20, 2026)
• Beazley Security Labs, BSL-A1233: Critical Remote Code Execution Vulnerabilities in PHP
• CERT-EU Security Advisory 2026-018 (PDF)
• CISA Known Exploited Vulnerabilities Catalog

← All briefs