The PHP Foundation released security updates for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to address two critical vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Both flaws received a CVSSv4 score of 9.2, indicating a high risk of unauthenticated remote code execution.
The vulnerabilities allow attackers to run arbitrary code on servers, potentially leading to data theft or full site takeover. The risk is particularly high for servers using the mod_php configuration in Apache, as the exploit can trigger before application-level security measures, such as login screens, are activated.
Following the disclosure, government agencies in Finland, France, and the Netherlands temporarily took websites offline as a precaution. Security firm Mallory estimated that approximately 884,000 internet-facing hosts were running PHP 8.1 or older as of October 20, leaving them potentially exposed to these exploits.
While the PHP Foundation provided source-code patches for older versions like 7.4, 8.0, and 8.1, official support is limited to version 8.2 and newer. Version 8.2 is scheduled to reach its end-of-life on December 31, 2026, after which it will no longer receive security updates.
Cloudflare deployed emergency firewall rules to mitigate known attack patterns for its customers. However, experts emphasize that patching remains the only definitive solution. Site owners are advised to verify their server update status, as automatic CMS updates may not apply these specific security patches.
