PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out

What it is

CVE-2026-109618 and CVE-2026-109619 are two PHP core flaws, both rated CVSSv4 9.2, that allow unauthenticated remote code execution. PHP shipped fixes on 21 October 2026 (about 13:35 UTC, a few minutes ahead of the announced 14:00 UTC) in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP security advisory says all users should update immediately.

How it works

CVE-2026-109618 occurs when PHP runs out of memory partway through a request and later treats the half-built data as complete. CVE-2026-109619 leaves data from one visitor's request in memory after it should be discarded, and a later request can use it. The page gives no deeper technical detail.

PHP says the risk is highest on Apache with mod_php, where a demonstrated exploit runs "before any application code runs". Login screens and WordPress security plugins therefore do not intervene. PHP Foundation researchers named the upload-progress feature as one confirmed entry point. It has been on by default for over a decade and few sites use it.

Preconditions / Affected

• Sansec puts the affected range at PHP 5.4 and later. Claims of "back to 2004" came from early estimates that CERT-EU said were based on social media posts.
• Official releases exist only for 8.2 to 8.5. The PHP security team also published bare-bones source patches for 7.4, 8.0 and 8.1, and Linux distributions are backporting fixes.
• Mallory counted about 884,000 internet-facing hosts advertising PHP 8.1 or older on 20 October 2026. That is 59% of the roughly 1.5 million hosts that show a version. Shared hosts carry many sites each, so the number of affected sites is higher.
• Only server operators need to act. Phones, browsers and laptops need no patch.

What to do

• Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply distribution backports. PHP core developer Gina Peter Banyard says patching or upgrading PHP is the only real mitigation.
• Ask your host whether PHP has been updated. Wordfence warns that WordPress automatic updates will not apply this fix.
• If you use the volunteer-run rpms.remirepo.net repository, the PHP Foundation says it will not have updates on 21 October. Move to distro packages or build from source.
• Sites on 8.1 or older need an upgrade plan or the source patches.
• Cloudflare deployed WAF rules for the known exploit vectors to all customers, including free plans. CTO Dane Knecht called them "a stopgap only" and said mitigations are being updated as new vectors appear.
• CERT-EU advises organisations that cannot patch to consider isolating internet-facing applications from public networks. Finland, the Netherlands and France took government sites offline on this basis.

Caveats

• Sansec expects "mass attacks to start within 15 minutes of the release", since attackers can diff old and new code. Cloudflare reported early attacks nearly six hours before the patch shipped.
• PHP 8.2 reaches end of life on 31 December 2026, so this fix is among its last.
• The page says Node.js had an unrelated security update on the same day.
• The article reports the NSA recommending that organisations using PHP shut down their sites. It does not source that claim further.