The developers of PHP, the programming language behind a large share of the world's websites, released fixes Wednesday for two critical vulnerabilities whose identifiers were posted online before the planned disclosure. European officials had told organizations that cannot patch to consider pulling affected sites off the public internet, Reuters reported. Because PHP is often installed and maintained by hosting providers and software vendors rather than the companies whose websites depend on it, leaders need to establish now who is responsible for updating each copy.
What Happened
In a security advisory Wednesday, the PHP team said PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws, which "can allow unauthenticated remote code execution," meaning an attacker could run commands on a server without logging in. The release followed an advance notice posted Oct. 20 that set it for 10 a.m. ET Wednesday and rated each flaw 9.2 under version 4.0 of the Common Vulnerability Scoring System, the industry's 0-to-10 severity scale.
The team said all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit lets a single unauthenticated request trigger the attack before any application code runs. CVE-2026-109618 involves out-of-memory handling that can leave request data partly initialized; CVE-2026-109619 involves internal state that can outlive the memory behind it and be reused by a later request.
PHP 8.1 and older no longer receive updates from the PHP project, though the team published minimal source fixes for PHP 7.4, 8.0 and 8.1 and said Linux distributions and long-term support vendors received patches in advance. It listed configuration changes that narrow specific attack paths but said they "do not make an installation safe," and that updating is the only safe choice.
CERT-EU, the European Union's computer emergency response team, covered the bugs in advisory 2026-018, "Critical Vulnerabilities in PHP." Where immediate patching is not possible, CERT-EU advised organizations to "consider isolating internet-facing applications from public networks." Reuters characterized the EU guidance as telling organizations to take affected sites offline.
The UK's National Cyber Security Centre, in an alert Wednesday, said organizations that cannot remediate immediately "should consider taking the system offline until it can be fully mitigated." Its listed steps: find every PHP system, starting with internet-facing ones; apply updates; check for compromise before patching any system that cannot be updated right away; and watch for fixes from vendors whose appliances and services bundle PHP.
The identifiers surfaced Oct. 20 in a since-deleted online forum post, ahead of coordinated disclosure, Infosecurity Magazine and BleepingComputer reported. Benjamin Harris, chief executive of security firm watchTowr, told BleepingComputer the bugs had been under embargo until Thursday and described both as CVSS 10, higher than PHP's own 9.2 rating. Public reporting has dubbed the pair "PHP2Shell."
Why It Matters
PHP runs about 69.7% of websites whose server-side language is known, according to W3Techs data cited by Infosecurity Magazine. Security firm Huntress noted in a blog post, cited by Reuters, that PHP underpins WordPress, Drupal, Joomla and Magento sites, shared hosting and control panels. Wordfence, which makes a WordPress security plug-in, said WordPress automatic updates will not apply this fix, Reuters reported. GoDaddy warned that the flaws could lead to data theft, website defacement or full system compromise.
Exploitation attempts began around the release. watchTowr saw its first attempts in the wild about when the patches landed, though none had succeeded, SecurityWeek reported. "We don't expect that will last long," said Jake Knott, its head of threat intelligence. Security firm Hadrian said hours before the release that the flaws were being exploited at scale, mostly through PHP's session upload-progress feature, according to SecurityWeek. Earlier Wednesday, Cloudflare Chief Technology Officer Dane Knecht said on X that attacks were emerging and called the company's firewall rules a stopgap until PHP's patch, while the Australian Cyber Security Centre said it was not aware of active exploitation, Reuters reported. SecurityWeek reported no confirmed compromises.
The leak shortened the time defenders had. Before the release, security vendor Sansec predicted to SecurityWeek that mass exploitation could begin within about 15 minutes of the patch, as attackers study the fixes.
For boards and executives, the immediate question is ownership: which internet-facing systems run PHP, who updates them, and which can be isolated or taken down without unacceptable business disruption if they cannot be patched quickly.
What to Watch
- Whether exploitation attempts turn into confirmed compromises.
- Patched builds from Linux distributions, hosting providers, container images and appliance makers that bundle PHP.
- Whether the U.S. Cybersecurity and Infrastructure Security Agency adds the flaws to its Known Exploited Vulnerabilities catalog.
