Two critical flaws in PHP: the fix is out, and your site needs updating

On Monday, October 20, a post appeared on the Hacker News forum. It claimed PHP contained two remote code execution flaws, with an attack tool to back it up. It was deleted, but screenshots were already circulating, Journal du Coin reported. The same day, researchers at watchTowr confirmed the flaws exist and reproduced the first one. For PHP’s security team, the coordinated disclosure schedule had just blown apart.

The team had announced a security update for October 21 at 14:00 UTC, without giving versions or the nature of the flaws, reserving the right to publish earlier if details became public. The fixes did come out on the 21st. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 on the CVSS 4.0 scale and let an attacker run code on the server remotely, according to France’s CERT-FR.

Which PHP versions are affected

• All 5.x, 7.x, 8.0.x and 8.1.x branches, which are no longer supported: they will not get an official fix.
• PHP 8.2 before version 8.2.35.
• PHP 8.3 before version 8.3.36.
• PHP 8.4 before version 8.4.27.
• PHP 8.5 before version 8.5.12.

Those versions come from CERT-FR alert CERTFR-2026-ALE-014, updated on October 22. A site running PHP 7.4 or 8.0, common on old hosting plans, will therefore get no vendor patch: it has to change version, or rely on a backported fix from the host or the Linux distribution.

Attacks already seen?

The sources do not say quite the same thing. Believemy, citing the security firm Sansec, reports attack attempts from October 21, the first detected by Cloudflare at 07:43 UTC. Huntress, for its part, had observed none among its customers as of October 20. CERT-FR says it has known of proofs of concept since October 22, for certain specific PHP deployments. At this stage no verified public exploit code has been identified; pages claiming to offer one are circulating and should be treated with suspicion.

What to do

• Shared hosting or managed WordPress: check with your host that PHP has been updated. In WordPress, the version is shown under Tools, Site Health, Info tab, Server section.
• A server you manage: install 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) through the package manager, after a full backup, then restart PHP-FPM or Apache.
• Unsupported version: plan the move to a maintained branch (8.3 or later) and, meanwhile, keep the server isolated from the internet as far as possible.
• In the meantime: CERT-FR suggests blocking, for example with a web application firewall, requests whose Content-Type header is multipart. Beware, this also blocks file uploads, including the WordPress media library.

watchTowr has not published the technical details. For administrators, the instruction fits on one line: inventory every server and container that runs PHP, including forgotten third-party software, then update them without waiting for the exploit to be published.