- Date
- October 21, 2026
- Kind
- Industry development
- Significance
- High
On October 21, 2026 PHP released fixes at 13:30 UTC for two vulnerabilities, CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (stale global state carried between requests). CERT-EU rated each 9.2 on CVSS; both allow unauthenticated remote code execution. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with source backports for 7.4, 8.0 and 8.1.
Responses
- CERT-EU “strongly recommends updating all affected PHP installations as soon as possible”; the NSA said systems should go offline if they cannot be updated.
- Google Search Central urged sites taking servers offline to serve a 503, because a 404 can remove indexed pages.
- OpenAI said GPT-5.6 Sol helped find one flaw; Cloudflare said its firewall blocked exploit attempts from 3:02 UTC and that the flaw leaked before release.
Not stated
Confirmed exploitation (CERT-EU reports none), the CVSS version and the number of vulnerable installations.
Why it matters
This is our analysis. PHP runs a large share of websites, including WordPress sites used for marketing, so a patch is a marketing continuity issue as well as a security one.
What happened next
Sites should update to a fixed version. CERT-EU says only an update fully fixes the flaws; temporary mitigations only reduce exposure.
Sources
- PPC Land: PHP servers face two 9.2-rated flaws that let attackers run code (opens in a new tab)
- PPC Land: Google tells sites patching PHP to serve 503, not 404, to keep pages indexed (opens in a new tab)
- PPC Land: Cloudflare blocks php2shell exploits 9 hours before PHP flaws went public (opens in a new tab)