The PHP project released emergency fixes on Wednesday for two critical vulnerabilities that let an unauthenticated attacker run code on a server. The release came a day earlier than planned because details leaked. The patches are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to the PHP Foundation. PHP runs an estimated 69% of websites with a known server-side language, per W3Techs. The FBI Cyber Division said the flaws "allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks".
What the two flaws do
CVE-2026-109618 comes from out-of-memory corruption. If a request hit PHP's memory_limit at the wrong moment, PHP could leave partly initialized data behind and later treat it as valid. The foundation said full remote code execution was demonstrated on Apache with mod_php under default settings, before any application code runs.
CVE-2026-109619 involves stale global state. A fatal error at the wrong point could leave internal pointers aimed at memory from a previous request. The next request on the same worker could then use that freed memory.
The foundation scores both at 9.2. Leaked reports had cited a CVSS of 10.0, and the official score is 9.2 on the v4.0 scale.
Upstream fixes cover only the 8.2 through 8.5 branches. Plesk said it built patched packages for end-of-life 8.1, 8.0 and 7.4 on Oct. 21. The Dutch NCSC told administrators to restart PHP-FPM or Apache after updating, because running processes keep executing the old code until then.
A leak, a video and an early release
The coordinated disclosure held until two days before the target date, the foundation said. At about 15:00 UTC on Tuesday, the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong score. The project moved its pre-announcement to 19:30 UTC and pulled the release forward to Wednesday at 14:00 UTC.
That evening Calif, one of the firms that reported the flaws, mistakenly published a video of its proof of concept. Copies spread after the deletion. At 07:41 UTC on Wednesday, Chainguard published built images containing the fix, more than six hours before the release. The foundation said any attacker could now study the fix in binary form.
Chainguard CEO Dan Lorenc told Recorded Future News he had seen exploitation attempts the night before and made a judgment call. In a Hacker News comment he wrote: "I made the call to get these out early when exploits hit in the wild". The PHP security team said it found no functional public exploit at release time.
Attack traffic and shutdowns
Cloudflare CEO Matthew Prince said on X that the network saw thousands of exploit attempts in the 10 hours before disclosure.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
The count rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and then millions. Cloudflare said it deployed protections about nine hours before disclosure, and free-plan users with the firewall enabled have them.
The agencies did not all report the same picture. CISA said it had not seen exploitation when it published its alert, and the two CVEs were not in its Known Exploited Vulnerabilities catalog on Wednesday. The NSA and FBI both advised organizations that cannot update right away to take systems offline. The UK's NCSC told them to consider it.
Sites went dark as a precaution. Dutch government sites, including the NCSC, went offline, and Nintendo took services down. Mitsubishi UFJ Financial Group suspended some internet services, and Japan's Ministry of Finance pulled parts of its site. Pixiv also paused operations.
A 2024 warning that stalled
The foundation traced the problem to a 2024 external audit by Quarkslab, funded through the Sovereign Tech Agency. A core developer found early signs of the out-of-memory issue while fixing another bug from the audit. Several competing fixes each carried trade-offs, and work stalled for months. "The delay was a structural failure," the foundation wrote.
Calif reported an unconditional code-execution path with the same root cause on Aug. 11, and OpenAI independently reported the same root cause that day. Wiz sent further vectors on Aug. 24. Computer Weekly's timeline says the White House was first made aware on Oct. 16.
The foundation created an Ecosystem Security Team in May. It said the security team has published 15 CVEs since July 1 and closed more than 100 reports that were invalid, duplicates or not reproducible. It is asking companies, hosting providers and governments to fund more engine engineers through sponsorship.
A separate maximum-severity flaw landed the same day. GitLab released fixes on Oct. 21 for CVE-2026-110264, a CVSS 10.0 bug that lets an unauthenticated user run code on self-managed servers. It follows CVE-2026-97229, another 10.0 flaw patched on Oct. 12. Security reports on the new bug say no active exploitation has been confirmed.
Gunel Ismayilova
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
