1. What is the PHP vulnerability?
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow an outsider to run commands on a web server without a password. Each carries a severity score of 9.2 out of 10. The PHP project shipped fixes on October 21, 2026, after exploitation attempts had already been observed, and the governments of Finland, the Netherlands and France responded by taking some public websites offline.
The security term for the weakness is unauthenticated remote code execution. In plain language, a stranger on the internet can make a vulnerable server carry out instructions of the stranger's choosing, without ever logging in. For the site's operator, that is the point at which someone else is effectively in control of the machine.
PHP is a server-side programming language, the software that assembles a site's pages before they reach a visitor's browser. According to the web survey firm W3Techs, it runs about 70% of the websites whose server-side language is known. Wordfence, a WordPress security company, notes that every WordPress site depends on it, which widens the potential reach considerably.
2. What could attackers do with these bugs?
A successful attacker could reach data stored on the server, including account details, addresses and order records. GoDaddy, the web hosting company, warned that an attacker able to execute code remotely could steal data, deface a website or take it over entirely.
Because the flaw is triggered before a site's own code starts running, ordinary defenses are bypassed. Login screens never come into play, and security plugins built for WordPress do not get the chance to intervene. PHP said the exposure is greatest on servers using the mod_php configuration with the Apache web server.
Researchers identified one confirmed route in: PHP's upload-progress feature. It has been switched on by default for more than a decade, even though relatively few sites actually make use of it.
3. How do the two bugs work?
The first flaw, CVE-2026-109618, concerns how PHP handles a request after it runs out of memory. The software can wrongly treat half-assembled request data as if it were complete and valid. The second, CVE-2026-109619, involves leftover data from one visitor's request that stays behind and can influence how the next visitor's request is processed.
A kitchen analogy helps. Imagine a cook who follows orders on tickets, and who sometimes picks up discarded tickets from the floor by mistake. If someone has planted a forged ticket there, the cook carries out whatever it says. In the server's case, the forged ticket is the attacker's code.
CVSS, the Common Vulnerability Scoring System, rates severity on a scale from 0 to 10, and anything at or above 9.0 counts as critical. Scores of 9.2 for both flaws put them close to the top of the scale, though short of a perfect 10.
4. How did the leak and the first attacks unfold?
The PHP Foundation, the nonprofit that funds the language's development, warned on X on Tuesday, October 20, that a release fixing two critical bugs would land at 14:00 UTC on Wednesday, October 21. It told users to prepare to update and said an earlier release was possible if details leaked or exploits appeared.
That is more or less what happened. On Tuesday, an anonymous online post claimed that two flaws would be disclosed on Thursday, although its author conceded having no real evidence. Security firm watchTowr then confirmed that the bugs were genuine and under embargo, the confidentiality period that lets maintainers prepare fixes before details become public. PHP moved its schedule forward by a day.
Cloudflare chief technology officer Dane Knecht reported that attacks had started roughly six hours before the patch was published. Cloudflare deployed emergency firewall rules to all of its customers, free accounts included, but described the measure as only a stopgap. The fix itself shipped around 13:35 UTC, a few minutes ahead of schedule, in four versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The accompanying security advisory urged everyone to update at once.
5. Why did governments switch off their websites?
Several governments chose to disconnect rather than wait. Finland began switching off government sites on Wednesday, with Valtori, the state IT service center, taking public services offline. The U.S. National Security Agency recommended that organizations running PHP shut their sites down. The Dutch national cybersecurity agency removed its own website, and France's Interior Ministry said prefecture websites would stay offline until a patch was applied.
CERT-EU, the European Union's emergency response team, advised organizations that had not yet patched to isolate their internet-facing applications. Australia, Japan and the United Kingdom issued similar guidance. None of this amounts to a cyberwar; it is a precaution taken because a working attack was circulating before most operators could update.
A released fix does not mean servers are protected. Each hosting provider, agency and company has to apply the update to its own machines, and that process happens unevenly across the internet.
6. Which PHP versions are affected?
Early social media threads claimed that versions going back to 2004 were vulnerable. That figure traced back to rough early estimates covering every PHP 5 release, an error CERT-EU later acknowledged. The security firm Sansec puts the affected range at PHP 5.4 and later, which reaches back to 2012.
Official fixed releases cover only PHP 8.2 and newer. The security team did publish source patches for versions 7.4, 8.0 and 8.1, and Linux distributions are backporting corrections to older packages. PHP 8.1 and earlier receive no official release.
That leaves a large population exposed. The firm Mallory counted about 884,000 internet-facing hosts running PHP 8.1 or older on October 20, around 59% of the roughly 1.5 million hosts that reveal a version. Shared hosting means the number of sites behind those hosts is larger still. Some viral posts also wrongly lumped in Node.js, which received an unrelated update on the same day.
Patched packages will not arrive everywhere at once. The PHP Foundation cautioned that the volunteer-run Remi repository would have no updates that day and recommended that administrators use their distribution's packages or build from source instead.
7. Should crypto users be concerned?
Ordinary users do not need to patch phones, browsers or laptops, because the vulnerable software runs on servers. The responsibility sits with site operators and hosting providers. Even so, crypto users have reason to pay attention, since a compromised web server can alter what a visitor sees. Wallets can be drained without any blockchain being attacked at all.
Past incidents show how this works. In 2024, attackers redirected the front ends of DeFi services including Compound and Celer, and a comparable attack hit Curve Finance in 2025. Those were domain-name hijacks rather than PHP flaws, but the trick is the same: the page looks correct while the approvals a user signs are routed elsewhere. A server under an attacker's control could present exactly such a page.
The incident also fits a wider concern. Experts who spoke about the subject in June said frontier artificial intelligence models are increasingly used to hunt for software vulnerabilities, which suggests more flaws may come to light in the future.
8. Why does a server-side flaw spread so widely?
Software that sits underneath thousands of products tends to turn a single defect into an industry-wide event. PHP is embedded in content management systems, online shops, forums and countless custom applications, and many of them are run by small teams or individuals who do not follow security bulletins. A flaw in the language itself therefore reaches far beyond the developers who chose to write in it.
Hosting arrangements add to the difficulty. On shared hosting, one provider manages the PHP installation for many customers, so the customers cannot fix the problem themselves and must wait for the provider. Smaller providers may be slower to react than large cloud platforms, and sites on forgotten servers may never be updated at all.
For that reason, the guidance from authorities focuses on reducing exposure while patches are rolled out. Taking a site offline is a blunt step, but a site that is switched off cannot be taken over. Isolating internet-facing applications, applying firewall rules and upgrading to supported versions are the measures security agencies describe, each of which buys time until every system can be patched.
The episode also shows how quickly the gap between disclosure and exploitation has shrunk. Attacks began before the fixed versions were even published, which left defenders with hours rather than days to prepare. Organizations that keep an inventory of the software they run, and know who is responsible for updating each piece, are far better placed to respond in such a window.
9. What happens next and what should site owners do?
Publication of a patch changes the threat rather than ending it. Attackers can compare the old and new code to work out exactly what was fixed and build their own exploits. Sansec expects mass attacks within 15 minutes of a release, and Akamai recorded exploit attempts within 24 hours of a different PHP flaw in June 2024.
Site owners should ask their hosting provider when PHP will be updated. Wordfence warned that automatic updates will not apply this fix, so manual action is needed. Anyone on PHP 8.1 or older must move to a supported version. PHP core developer Gina Peter Banyard said on Mastodon that patching or upgrading is the only mitigation, and added a dry remark that they know too much about the subject.
One more date matters for the longer term: PHP 8.2 reaches end of life on December 31, 2026, so this correction is among the last it will receive.