PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

Public-sector websites across Finland and the Netherlands went dark on Wednesday, October 21, 2026, after emergency warnings exposed two critical remote code execution flaws hiding inside the PHP programming language. State IT agencies and educational institutions pulled services offline as a precautionary measure, racing to beat threat actors who had already begun probing web servers for access. The disruption rippled across government portals, parliamentary platforms, and university networks just hours before the PHP security team pushed out urgent patches to neutralize the threat.

The emergency update addresses two heap use-after-free primitives in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c), carrying identifiers CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities earned a severe 9.2 rating on the CVSS v4.0 scale. Because these bugs reside directly within the language engine rather than in website code, standard application updates for platforms like WordPress, Laravel, or Magento offer no protection. Attackers targeting these flaws can execute arbitrary code on a server without authenticating.

The scramble to patch began on October 20, 2026, when a post on Hacker News prematurely revealed the existence of the vulnerabilities and their CVE identifiers, prompting PHP maintainers to accelerate their disclosure schedule from Thursday, October 22, to Wednesday, October 21, at 14:00 UTC. Security firm watchTowr confirmed that the leak broke a coordinated confidentiality arrangement and successfully reproduced CVE-2026-109618 in lab testing. Cloudflare CTO Dane Knecht reported that the infrastructure firm observed early exploit attempts emerging in real time, forcing network operators to deploy rapidly evolving mitigation rules as attackers discovered new vectors.

The Patch Timeline, Upstream Support, and Shodan Exposure Data

The emergency fixes arrived as PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Yet the strict support lifecycle enforced by the PHP project leaves millions of legacy installations exposed to permanent vulnerability. PHP officially supports only four active release branches: 8.2 and 8.3 for security fixes, alongside 8.4 and 8.5 in active support. Older branches including PHP 8.1, 8.0, 7.x, and 5.x are end-of-life and will not receive official upstream patches from the vendor.

Data compiled by security firm Mallory using Shodan search engine statistics from October 20, 2026, shows the scale of the legacy footprint. Approximately 884,000 internet-visible hosts reported running PHP version 8.1 or earlier, accounting for 59% of the roughly 1.5 million hosts that disclosed an HTTP banner version. An additional 740,000 hosts reported running PHP without specifying a version number. Security researcher Florian Roth warned that servers locked into legacy PHP 5 and PHP 7 branches face an unprotected operational environment without direct vendor patches.

I have successfully recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619 > Two heap use-after-free primitives in PHP's session.upload_progress handler(php_session_rfc1867_callback, ext/session/session.c)…#CyberSecurity #infosec #php #C4b1NKr3W #php2shell

Security Researcher, via Security Affaires

Attack telemetry from Sansec indicated that exploitation tools labeled php2shell could target any version after PHP 5.4.0, while web technology surveyor W3Techs estimated that end-of-life PHP 7 and PHP 5 installations still comprise roughly 34.7% of all PHP-driven websites.

Defensive Posture, Mitigations, and Verification Steps

Administrators managing web applications face difficult choices when immediate patching is impossible. CERT-EU and the UK National Cyber Security Centre recommended isolating internet-facing applications from public networks or taking vulnerable services offline entirely. Security firms emphasized that Web Application Firewalls and proxy rules provide only temporary stopgaps rather than permanent security. Cloudflare deployed emergency WAF rules, but acknowledged that attackers continuously adapted their attack patterns.

For systems running supported PHP branches, updating the runtime package requires an immediate restart of Apache, PHP FPM, and long-running worker processes. The Hacker News noted that administrators relying on Linux distributions should inspect package changelogs for specific CVE identifiers rather than relying on upstream version strings, because operating system vendors frequently backport security fixes into older package versions.

To verify server vulnerability and protect production environments, administrators should execute the following operational checks:

• Inspect active server inventory to identify every host running PHP, noting whether the deployment relies on Apache mod_php, PHP-FPM, or CGI execution modes.
• Check WordPress server configurations by navigating to Tools, selecting Site Health, opening Info, and expanding the Server section to confirm the exact active PHP runtime version.
• Audit process activity on Linux hosts using process-watchers to detect PHP worker processes launching unexpected shell interpreters, curl, wget, or python commands.
• Review post-patch environments for indicators of prior compromise, including unauthorized administrative accounts.

With the emergency patches now published, the central question facing corporate security teams is whether legacy infrastructure operators running unsupported PHP branches can migrate or isolate their assets before automated threat actors weaponize the php2shell exploits at scale.