PHP has released emergency security updates for two critical vulnerabilities that can enable remote code execution on vulnerable web servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, reportedly affect a broad range of PHP installations.
Administrators should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the branch in use. Ubuntu has also distributed updated PHP packages.
The KrebsOnSecurity report describes both vulnerabilities as zero-days and says experts have observed working exploits and in-the-wild attacks. Cloudflare separately reported detecting some exploitation and said it deployed web application firewall rules at 3:02 a.m. UTC.
How the two PHP vulnerabilities work
Both bugs involve unsafe memory handling between PHP request-processing contexts, but they reach that condition through different mechanisms.
For CVE-2026-109618, PHP uses longjmp() to exit the current context when an out-of-memory error occurs and abort the request. In some contexts, the software can subsequently perform an allocation while request memory remains uninitialized. Cleanup code may then read that memory or make control-flow decisions based on its contents. According to the NVD description, multiple out-of-memory strategies can reliably reach this condition and result in remote code execution.
CVE-2026-109619 concerns global PHP state that temporarily points into memory belonging to a request. That state may not be reset correctly, or it may be populated again after a reset. It can therefore continue referencing request memory after the memory has been freed. A later request may read or branch on this stale state before initialization is complete, again creating a path to remote code execution.
Both vulnerabilities are associated with the classifications CWE-416, CWE-755, CWE-824, and CWE-1325, covering use-after-free behavior, improper handling of exceptional conditions, access to uninitialized pointers, and improper control of sequential memory allocation.
A wide but differently described affected scope
The report says web servers running PHP 5.4 or later are affected. Wiz, one of the organizations credited with discovering the flaws, states that every PHP release from the last decade is vulnerable to at least one of the two bugs.
The same report says nearly 70 percent of websites need to update their core software, although it does not identify the source of that estimate. This percentage refers to websites, not to a count of servers, customers, accounts, or affected people.
PHP is widely used by websites built with Drupal, Magento, Joomla, and WordPress. That does not mean the vulnerabilities reside in those content-management and commerce platforms: the reported defects are in the underlying PHP runtime.
Exploitation could lead to server takeover and data exposure
Cloudflare listed denial of service, remote code execution, and data exposure among the possible consequences. Its WAF rules may help block recognized attack traffic, but they do not replace installation of the corrected PHP packages.
Wiz expects attackers to pursue large-scale exploitation and deploy web shells. A web shell would give an intruder a browser-accessible mechanism for issuing commands and maintaining remote control over a compromised site. This is Wiz’s assessment of likely attacker behavior, not evidence that every observed attempt has installed such a tool.
Reuters, as cited by KrebsOnSecurity, reported that government websites in Europe and other regions became unavailable following disclosure of the vulnerabilities. The reporting did not establish that the PHP flaws caused those outages.
Wiz and OpenAI describe AI-assisted exploit research
Wiz said demonstrating exploitability required an “exceptionally complex chain of steps.” The company claims frontier AI models substantially reduced that technical barrier.
OpenAI was reportedly involved in vulnerability research and outreach, while Wiz said it coordinated with the PHP team and OpenAI before public disclosure to assess the potential scope, verify patches, and prepare disclosure. The claimed contribution of AI models remains a statement from the organizations involved rather than an independently demonstrated capability.
OpenAI characterized the pair as “one of the most impactful security issues in recent memory,” citing both their severity and PHP’s extensive deployment. Wiz compared the potential remediation challenge with Log4Shell and said the PHP defects had existed for decades.
What PHP administrators should do
Operators should identify the PHP version running on internet-facing and internal servers, including installations supplied through hosting panels, containers, appliances, and operating-system repositories. The available corrected releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Ubuntu users should apply the updated PHP packages supplied through the distribution. Organizations using Cloudflare can benefit from its newly deployed WAF protections, but should still patch the runtime itself.
Because exploitation has been reported, exposed PHP systems should be prioritized rather than left for a routine maintenance cycle. After updating, administrators should review server activity for unexpected web-accessible files, unexplained command execution, unusual child processes, and unauthorized changes that could indicate a web shell or earlier compromise.
