Critical PHP vulnerabilities: POC released, attacks starting

A pair of critical vulnerabilities in the PHP scripting language are under early active attack.

The CVSS 9.4 vulnerabilities have been allocated CVE-2026-109618 and CVE-2026-109619 .

They allow unauthenticated remote code execution (pre-auth RCE) attacks. Vast swathes of the internet use PHP.

PHP said the following are at risk:

All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

RCE via OOM corruption , CVE-2026-109618 ( GHSA-w8hw-w9fx-j79w ): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

RCE via stale global state , CVE-2026-109619 ( GHSA-6wmf-4rv5-p3rp ): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are fixed versions.

The PHP Foundation's full advisory is here.

Cloudflare CTO Dane Knecht posted on Wednesday said: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

Over two million internet-facing hosts may be exposed. CERT-EU warned : "CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available."

The UK's NCSC said it is "encouraging UK organisations to prepare for immediate updating of systems using PHP.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Phoenix Security’s Marcus Webb added: “A core RCE affecting multiple major branches turns a routine dependency into a direct attack surface across content management, e-commerce, and custom web services at the same time.

“The exposure problem is made worse by version age: a large population of internet-facing hosts runs end-of-life PHP 5 and PHP 7, and those branches are not expected to receive a fix.” (PHP sits under a large of the internet.)

Various POC exploits are circulating. Most appear to be AI slop. Expect effective real POCs to land very shortly and commoditised attacks to start.

Critical PHP vulnerabilities: All versions affected?

. The PHP security team only typically releases official security updates for supported active branches (PHP 8.2+).

The ever-industrious Florian Roth of Nextron Systems said he had prepared an open-source tool dubbed process-watcher for “everyone who doesn’t know what to do right now” after news emerged of the PHP vulnerabilities last week.

He wrote: “process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage.

“And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability. From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes.

“It can also kill the ones you name (dry run first), but it's a detection layer, not a patch , and it can't see anything that happens inside PHP without starting a process.”

A quick start for process-watcher is here . The project is here .

Saeed Abbasi, Head of Threat Research Unit at patch management specialist Qualys urged security teams to “inventory PHP installations and identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed. PHP 8.1 and earlier are no longer supported by the upstream PHP project, making these systems a priority for upgrade planning.”

Editor’s note: We trust Florian, but as ever with all things software, use at your own risk.

Know more than us already or have a working POC? Get in touch [email protected] / Signal @Targett.11

Edward Targett Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.