Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploited

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploited

First seen 22 Oct 2026, 15:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 23:13 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with CVSS 9.2.
  • •Exploitation attempts are already underway, targeting millions of PHP installations.
  • •Immediate patching is essential, especially for unsupported PHP versions.

PHP has released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both assigned a CVSS score of 9.2. These vulnerabilities affect all PHP installations serving web requests, including PHP-FPM and Apache with mod_php. Exploitation attempts have already been reported, with hackers targeting millions of internet-facing PHP installations, particularly older, unsupported versions. The flaws allow unauthenticated remote code execution through out-of-memory handling and use-after-free memory errors. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been patched, while versions below 8.2 remain vulnerable and unsupported. Security experts urge immediate patching to mitigate risks, as early attacks have been observed in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2015-06-09
CVE-2015-4024 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
PHP disclosed two critical vulnerabilities allowing unauthenticated remote code execution.
Techradar
2026-10-22
Emergency patches released
PHP released patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, urging users to update immediately.
Schneier
2026-10-22
Exploitation confirmed
Cloudflare reported early exploitation attempts targeting the vulnerabilities before patches were available.
Techradar

More articles in this cluster (41)

Following this threat?

Track Debian and CVE-2015-4024 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (36)

1 / 4

Common questions

Which PHP versions are affected?
All PHP versions serving web requests, especially those below 8.2, which are end-of-life and unsupported.
How urgent is the patching?
Very urgent; exploitation attempts have already been reported, and millions of installations are at risk.
What should I do if I can't patch immediately?
Consider disabling PHP on exposed servers or restricting access until you can apply the patches.