Critical PHP Flaws Prompt Emergency Patches and Precautionary Shutdowns

PHP developers have released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow an unauthenticated attacker to run code remotely. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both flaws carry a CVSS score of 9.2, according to CERT-EU. All PHP installations serving web requests are potentially affected, including those using PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed. The developers consider the risk highest for mod_php, where a demonstrated exploit can trigger the attack before any application code runs.

Exploitation attempts have already begun. Jake Knott of watchTowr said its sensors are seeing a variety of proof-of-concept exploits, with no successful attacks observed so far, though he does not expect that to last. CERT-EU advised that where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks. Finnish government services and websites belonging to the Dutch parliament, cybersecurity authorities and data protection regulator were taken offline as a precaution, and privacy group noyb temporarily withdrew its site.

Finding every affected system may be the hardest part. Huntress noted that PHP powers WordPress, Drupal, Joomla, Magento, shared hosting platforms, control panels and plenty of software that does not advertise its use of PHP. As Huntress researcher John Hammond put it, the number of places to look for vulnerable PHP versions gets very big, very fast.