What we know (10/21/2026 – 12 p.m.)
- Both flaws would allow remote code execution, i.e. taking control of a server. The first reports suggest possible exploitation without authentication.
- PHP is releasing an out-of-cycle security release today, at 4:00 p.m. French time.
- No active exploitation is reported at this stage.
- The affected versions, the component in question and the operating conditions will be specified upon publication. The mention of “all versions since PHP 5”, resulting from a leak, is not officially confirmed but it is recommended to take it into account as a precaution.
⚠️ The major point of attention
Only branches 8.2 to 8.5 will receive a patch. Versions 8.1 and earlier are end of life. If they are affected, they will remain without a patch. According to a Shodan survey, approximately 884,000 exposed servers display version 8.1 or older.
⏱️ Why the next few hours matter
As soon as a patch is published, attackers analyze it to understand the flaw, then target non-updated systems. In 2024, the PHP vulnerability CVE-2024-4577 was the subject of exploitation attempts in less than 24 hours.
✅ What we recommend
- Inventory: servers, applications, CMS, appliances and hosting panels that embed PHP, with their versions.
- Prepare to update at 4:00 p.m., starting with systems exposed on the Internet. If possible, disable vulnerable applications exposed to the Internet.
- Is your site managed by a service provider or host? Ask them today about his action plan..
- For end-of-life versions: migrate or restrict access (VPN, WAF), or even temporarily isolate, as suggested by CERT-EU (https://cert.europa.eu/publications/security-advisories/2026-018/). Adapt the measurement to the criticality of the service, because isolation results in interruption.
- Monitor: Alert if php-fpm, php-cgi or apache2 launches a shell or download tool.
Two mistakes to avoid: ignoring the alert because no attack is confirmed, or believing that any PHP site is already compromised. Using PHP is not enough to make a site vulnerable. Everything will depend on the version and configuration
The Brightway CERT is monitoring the situation and will update this alert when the official notice is published.
Update (4:15 PM)
This afternoon PHP released the fixes for the two critical vulnerabilities announced this morning (available here). Their identifiers are now confirmed: CVE-2026-109618 and CVE-2026-109619.
🔎 What we now know
- Both flaws allow remote code execution without authentication.
- Every PHP installation that handles web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php setups are the most exposed.
- A working exploit has been demonstrated. A single unauthenticated request is enough, even before any application code runs.
✅ Fixed versions
PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35
⚙️ Depending on your setup
- Linux distribution packages or LTS vendor: vendors received the fixes ahead of the public release. Check now whether updated packages are available.
- PHP 8.1 and earlier (end of life): upgrade to a supported branch or contact your LTS vendor. PHP has also published minimal source backports for 7.4, 8.0 and 8.1, which you need to build from source.
- Remi repository (rpms.remirepo.net): no updates are expected there today. Switch to your distribution’s packages or build from source.
- Sites behind Cloudflare: WAF rules targeting the known exploit vectors are already deployed, including on the free plan. They are an additional layer of protection, not a substitute for patching.
- Systems that cannot be patched right away: the UK NCSC advises considering taking them offline.
⚠️ The risk window opens now. An exploit exists and the fixes are public, so attackers can quickly target unpatched servers. Patch internet-facing systems first. Don’t forget “forgotten” applications and devices with embedded PHP.