What changed
On Wednesday, the PHP Foundation released emergency security updates to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations serving web requests since PHP version 5. The patches are only available for PHP 8.2 and newer, as older versions are no longer supported. The PHP Foundation emphasized that updating is the only safe mitigation, as no complete fixes are available for legacy systems.
What this means in practice
The vulnerabilities, which reside in PHP's file upload interface, could allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, including passwords, API keys, and certificates. Security experts warn that the flaws are easily exploitable, with some researchers claiming they can be exploited 'fairly easily.'
The widespread use of PHP in critical infrastructure, such as WordPress, Drupal, and Magento, means millions of systems could be at risk.
Security consultant Davi Ottenheimer described the vulnerabilities as a 'front door with no lock,' noting that attackers do not need to know the target site or software to launch an attack.
Some organizations, including Finnish and French government websites, took their systems offline as a precautionary measure before the patches were released.
Limitations and availability
The PHP Foundation noted that some legacy PHP distributions and third-party vendors may still provide fixes for older versions, but these are not guaranteed. The vulnerabilities were first disclosed on October 20, with the PHP Foundation giving 'advance notice' of the flaws. While the exact details of the vulnerabilities were not initially disclosed, the Common Vulnerability Scoring System (CVSS) assigned a 'critical' score of 9.2 to both flaws.
Security firms like Wiz, OpenAI, and Calif independently discovered the vulnerabilities, with Wiz researchers demonstrating an exploitation method called 'php2shell.' The PHP Foundation warned that if details of the vulnerabilities become public or evidence of active exploitation appears, they may release the patches earlier.
The urgency of the situation has prompted alerts from multiple cybersecurity agencies, including the UK’s National Cyber Security Center (NCSC), which advised organizations to prepare for immediate system updates.
