A pair of critical vulnerabilities in the PHP scripting language are under active attack.
The CVSS 9.4 vulnerabilities are believed to have been allocated CVE-2026-109618 and CVE-2026-109619 although the PHP foundation has yet to confirm identifiers.
PHP is pushing a patch and more details live at 14:00.It gave advance warning publicly on Tuesday (October 20) saying “PHP users are encouraged to prepare to update.”
The vulnerabilities are believed to be remotely exploitable and in the core engine of all PHP versions. Cloudflare CTO Dane Knecht posted on Wednesday said: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
Over two million internet-facing hosts may be exposed. CERT-EU warned: "CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available."
Phoenix Security’s Marcus Webb added: “A core RCE affecting multiple major branches turns a routine dependency into a direct attack surface across content management, e-commerce, and custom web services at the same time.
“The exposure problem is made worse by version age: a large population of internet-facing hosts runs end-of-life PHP 5 and PHP 7, and those branches are not expected to receive a fix.” (PHP sits under a large share of the internet.)
Various POC exploits are circulating. Most appear to be AI slop. Expect effective real POCs to land very shortly and commoditised attacks to start.
Critical PHP vulnerabilities: All versions affected?
PHP 5.0 through PHP 8.x are understood to be affected. The PHP security team only typically releases official security updates for supported active branches (PHP 8.2+).
The ever-industrious Florian Roth of Nextron Systems said he had prepared an open-source tool dubbed process-watcher for “everyone who doesn’t know what to do right now” after news emerged of the PHP vulnerabilities last week.
He wrote: “process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage.
“And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability. From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes.
“It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.”
A quick start for process-watcher is here. The project is here.
Saeed Abbasi, Head of Threat Research Unit at patch management specialist Qualys urged security teams to “inventory PHP installations and identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed. PHP 8.1 and earlier are no longer supported by the upstream PHP project, making these systems a priority for upgrade planning.”
Editor’s note: We trust Florian, but as ever with all things software, use at your own risk. We will update this story as soon as PHP pushes a detailed advisory.
Know more than us already or have a working POC? Get in touch ed@thestack.technology / Signal @Targett.11
