Skip to content
Critical RCE Vulnerabilities in PHP Servers Require Immediate Action

Critical RCE Vulnerabilities in PHP Servers Require Immediate Action

First seen 28 Oct 2026, 15:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:39 UTC
  • •Two critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) require immediate patching.
  • •Active exploitation has been confirmed since October 17, 2026, affecting PHP servers globally.
  • •Administrators must restart web services after applying patches to close the security gap.

On October 21, 2026, the PHP foundation released emergency patches for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP modules like mod_php and PHP-FPM. Despite these patches, PHP servers remain vulnerable due to lingering pre-patch processes in memory that continue to execute requests with the outdated runtime. Active exploitation of these vulnerabilities has been confirmed since October 17, with attackers able to execute arbitrary code on compromised servers. Administrators are urged to restart web services after applying patches to mitigate the risk. The vulnerabilities are particularly concerning as PHP powers approximately 70% of websites, including major content management systems like WordPress and Joomla. Forensic analysis of logs is recommended for systems suspected of compromise. Failure to address these vulnerabilities could lead to unauthorized access and data exfiltration.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
PHP releases emergency patches
The PHP foundation disclosed critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, releasing patches to address them.
Threatlocker
2026-10-26
CVE-2026-109619 added to CISA KEV
CISA added CVE-2026-109619 to its Known Exploited Vulnerabilities catalog due to confirmed active exploitation.
Dev.To
2026-10-26
CVE-2026-109618 added to CISA KEV
CISA also included CVE-2026-109618 in its KEV catalog, highlighting the ongoing exploitation risk.
Dev.To

More articles in this cluster (2)

Following this threat?

Track LiteSpeed and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions running mod_php, PHP-FPM, php-cgi, and others, particularly those before the patches were applied.
How can I mitigate the risk?
Immediately apply the patches and restart your web services to terminate any vulnerable processes still in memory.
Is there evidence of exploitation?
Yes, active exploitation of these vulnerabilities has been confirmed since October 17, 2026.