Critical Remote Code Execution Flaws Put Millions of Servers at Risk
On October 21, 2026, the PHP Project released patches for two critical vulnerabilities – CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, which enable unauthorized Remote Code Execution (RCE). The European governments have reacted by taking some websites offline.
This article explores what is PHP, the vulnerabilities that are detected, attacker way of exploitation, government taking actions on this emergency alert. Moreover, we’ll explore the severity of vulnerabilities, and how to prevent your website from exploitation.
But What Exactly Is PHP?
PHP is an open-source server-side programming language that is utilized by popular content management systems as WordPress, e-commerce platforms and enterprise solutions. According to the stats of W3Techs, PHP operates in about 69% of all websites having server-side language.
Vulnerability Overview
Following are the two PHP vulnerabilities discovered by Artificial Intelligence and reported to the higher authorities.
CVE-2026-109618: a bug in out-of-memory handling. PHP handles partially initialized internal data causing memory corruption.
CVE-2026-109619: use-after-free vulnerability. Old request state may be accessed by another request within the same worker process.
Details were released in order to hasten the release by the PHP team and also to confirm the reproduction of the first one by watchTowr security company.
How Attackers Can Exploit It
Exploitation reportedly requires neither login nor user intervention nor exploitable application code, because the exploits target something before application code is loaded. One possible exploit chain targets the `session.upload_progress` functionality, which is enabled by default. Possible objectives of the attackers include:
- Web shell and backdoor deployment
- Databases and credentials theft
- Ransomware or cryptominer deployment
- Site defacement or internal network penetration
Cloudflare reportedly detected attempts to exploit the vulnerability prior to the patch being released.
Why Governments Took Websites Offline
The Netherlands government (including DigiD), Finns, Belgians and French shut down some of their services out of caution, while Germany’s federal IT provider shut down several websites. The FBI and NSA recommended taking offline any systems that could not be patched quickly. It was claimed there were no active attacks at the time of the shutdowns.
Scale of Vulnerability
Palo Alto Networks detected more than 22.6 million potentially vulnerable internet-facing systems. This does not mean there were any actual compromises or unique websites.
Remediation Steps
- Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- For 7.4, 8.0 and 8.1, apply the official source backports.
- Restart PHP-FPM or the web server and verify with `php -v`.
- Check containers, hosting accounts and third-party products for bundled PHP.
- Review logs from October 20 onward for unexpected processes, web shells and file changes.
Plugin or CMS updates alone do not resolve these flaws, and automatic OS updates may not apply the fix.
Conclusion
CVE-2026-109618 and CVE-2026-109619 represent some of the most severe flaws in web infrastructure in recent years. The vulnerabilities are based in PHP, they require no login, and they enable attacks against millions of servers. The fact that services have been shut down by governments across Europe demonstrates the severity of the risk.
Your course of action should be based on three main steps:
Patch immediately. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart your PHP process.
Detect the compromise. Patching your system will prevent any further compromise, but it will not tell you if an attack occurred. Look at your logs since October 20 for web shells, unusual processes and modified files.
Deprecate legacy PHP systems. Legacy products are not supported anymore and you have no choice but to migrate to a newer product.
For companies who rely on web scraping, this news brings a second issue to consider – prepare for outages and unexpected changes in site behavior as organizations around the world implement patches.
There is no price for being proactive in cybersecurity and the cost of procrastination can easily equal a complete data breach.
