PHP Emergency Fixes Close Two Critical Remote Code Execution Flaws Already Under Attack

Operators running any unpatched PHP since version 5.4 are exposed, and the advisories say updating and restarting every worker is the only safe fix.

PHP's maintainers pushed emergency releases on October 21 that fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 and capable of unauthenticated remote code execution, present in every unpatched PHP back to 5.4. Attacks were already underway: Amazon Threat Intelligence logged an attempt traced to October 17 from an anonymisation network, and Cloudflare deployed WAF rules roughly nine hours before the fixed releases. Coordinated disclosure broke down when identifiers leaked early, a researcher published a proof-of-concept video, and Chainguard released built images containing the fix ahead of schedule. Exposure depends on the server model, with Apache mod_php confirmed exploitable, PHP-FPM only partly demonstrated, and FrankenPHP judged likely vulnerable from source analysis. Operators are told that updating is the only safe option and that every worker must be restarted, and distro package versions can mislead, since backported fixes keep the old upstream version string. Sansec now believes the public exploits fail against a default installation, though attack complexity is rated high and practitioners warn that many proof-of-concept repositories are unreliable or malicious. A third issue, CVE-2026-115560, remains unpatched, and PHP advises disabling session.upload_progress.enabled until a later bugfix release.