Skip to content
Critical PHP Vulnerabilities Disclosed: 22 Million Instances Exposed

Critical PHP Vulnerabilities Disclosed: 22 Million Instances Exposed

First seen 22 Oct 2026, 11:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 12:14 UTC
  • •Two critical PHP vulnerabilities disclosed with CVSS scores of 9.2.
  • •Over 22 million PHP instances are potentially vulnerable.
  • •Proof-of-concept exploits are already available, increasing urgency for patching.

On October 21, 2026, the PHP project disclosed two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS 4.0. These vulnerabilities can be exploited by unauthenticated attackers, affecting over 22 million exposed PHP instances. The vulnerabilities are particularly severe for mod_php installations, where an unauthenticated request can trigger an attack before any application code runs. Proof-of-concept exploits for both vulnerabilities have already been observed, prompting some European governments to take precautionary measures by taking their websites offline. Organizations using Palo Alto Networks' Frontier Virtual Patching were protected from these vulnerabilities before their public disclosure. The PHP security team released patches on the day of disclosure, but organizations must still address the challenge of patching numerous PHP instances quickly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
CVE-2026-109619 published
PHP project disclosed a critical remote code execution vulnerability, CVSS 9.2, with proof-of-concept available.
X
2026-10-22
CVE-2026-109618 published
Another critical remote code execution vulnerability disclosed, CVSS 9.2, with proof-of-concept available.
Paloaltonetworks

More articles in this cluster (2)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

What are the CVE identifiers for the vulnerabilities?
The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
How can organizations protect themselves?
Organizations should apply the patches released by the PHP project immediately and consider using virtual patching solutions.
What is the risk level of these vulnerabilities?
Both vulnerabilities are rated critical with a CVSS score of 9.2, indicating a high risk of exploitation.