Live updates: this post is a snapshot. For the latest on CVE-2026-109618 and CVE-2026-109619, follow the Mallory story . It updates automatically as advisories, exploits and attack activity appear.
PHP ships fixes on Wednesday, October 21 at 10:00 AM EDT for two critical remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 . Only PHP 8.2 and later get patches. Our review finds 884,000 internet-facing hosts running an older end-of-life version.
Find every internet-facing PHP host and record its version and SAPI (PHP-FPM, mod_php, php-cgi).
On 8.2 or later: schedule an emergency patch for the 10:00 AM EDT release.
On 8.1 or earlier: there is no patch. Upgrade to a supported branch, or restrict access (VPN, IP allowlist) or take the host offline until you can.
Ask vendors and hosting providers appliances and managed hosting that bundle old PHP.
Prepare detection: watch for unexpected child processes of the web server and new files in web roots, and have WAF rules ready to deploy.
Where the unpatched hosts are
Of 1.5 million internet-facing hosts that report a PHP version, 59% (883,717) run a branch that will get no fix. China, South Korea and Hong Kong have the highest unpatched shares. Algeria is almost entirely PHP 5.3 on Telecom Algeria.
Most of these hosts sit with a few providers: Amazon (over 290,000), Hostinger (142,401), Alibaba Cloud (81,078), Hetzner (51,354), DigitalOcean (47,105) and OVH (36,848). Shared hosting puts many sites on one IP, so far more websites are affected than hosts. The real count is also higher, because 740,000 PHP hosts hide their version. Some distro packages (Debian, Ubuntu, RHEL) may backport fixes to older versions.
What the public code shows
Before the release, we reviewed recent php-src commits and open pull requests for any hint of what the fixes cover. We found nothing that confirms either CVE. The release branches have no unreleased commits, and PHP develops embargoed fixes privately, so the two flaws are not expected to show up in public code before October 21.
PHP project: Upcoming Critical PHP Security Release , October 20, 2026
Host counts: Shodan /shodan/host/count , October 20, 2026. "X-Powered-By: PHP" for the total (2,237,277) with country, org, port and city facets; "X-Powered-By: PHP/ " once per branch from 5.2 to 8.5 for versions; http.component:"PHP" as a cross-check (1,906,831). Counts are banners Shodan has seen recently, not unique organizations.
Find the PHP hosts that won't get a fix
Mallory maps CVE-2026-109618 and CVE-2026-109619 to your attack surface and tracks exploits and attack activity as they appear.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
