Palo Alto Networks on X

Back X

Palo Alto Networks on X

X • October 21, 2026

Share: View original

22 million exposed PHP instances. Two critical vulnerabilities, each with a CVSS score of 9.2.

As frontier AI accelerates vulnerability discovery, patch-to-exploit windows are shrinking. Manual remediation alone can't keep pace.

Lee Klarich shares what organizations must do now.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Disclosed: 22 Million Instances Exposed On October 21, 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0. These vulnerabilities can be exploited by unauthenticated attackers, affecting over 22 million exposed PHP instances. The vulnerabilities are particularly severe for mod_php installations, where an unauthenticated request can trigger an attack before any application code runs. Proof-of-concept exploits for both vulnerabilities have already been observed, prompting some European governments to take precautionary measures by taking their websites offline. Organizations using Palo Alto Networks' Frontier Virtual Patching were protected from these vulnerabilities before their public disclosure. The PHP security team released patches on the day of disclosure, but organizations must still address the challenge of patching numerous PHP instances quickly. 2 sources 72

Extracted Entities

Vulnerabilities (1)

Two Critical Vulnerabilities