The PHP security team has announced a security release for 14:00 UTC on October 21 that fixes two critical vulnerabilities, both rated CVSS v4.0 9.2, and the UK’s NCSC and the EU’s CERT-EU are telling organisations to find their PHP systems before the patch arrives.
What PHP has said so far
In its October 20 advance notice, the PHP security team said the release “addresses two critical vulnerabilities, both rated CVSS v4.0 9.2” and asked all PHP users to prepare now so they can upgrade as soon as it is available. The team reserved the right to release earlier if details of either flaw become public or evidence of active exploitation appears. Full details and affected versions come with the release.
Tenable’s research team lists the identifiers as CVE-2026-109618 and CVE-2026-109619, and says public reporting describes both as remote code execution flaws. The PHP team has not published technical details. Tenable says a video demonstrating an exploit chain, dubbed php2shell, has circulated.
What the agencies tell defenders to do
The NCSC alert asks UK organisations to prepare for immediate updating of systems using PHP and says that where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. Its action list has five items: identify systems running any version of PHP, prioritising internet-facing ones; monitor internet-facing PHP systems for malicious activity; follow the official PHP guidance; apply updates as they become available; and watch for updates from third-party vendors, including appliances and services that may bundle PHP.
CERT-EU’s Security Advisory 2026-018 reaches the same place. It says the CVSS scores indicate the potential for unauthenticated remote code execution, that the flaws could affect all PHP versions from PHP 5 onwards, and that organisations should consider isolating internet-facing applications from public networks until a fix can be applied. It also notes that no technical details were available when it was written.
Which versions get a fix
The official list of affected and fixed versions was not out when this article was written. Tenable relays the versions that researcher Kevin Beaumont reported ahead of the release: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Tenable also says end-of-life branches, PHP 5.x through 8.1.x, are not expected to receive official fixes, and that Linux distributions shipping older PHP packages may backport fixes, so teams running distribution packages should read their vendor’s advisory.
That split matters for planning. A server on a supported 8.x branch has an upgrade path on release day. A server on 7.4 or 8.0 has to be migrated, isolated or retired, and none of those is a same-day job.
What is known about exploitation
Tenable reports that Cloudflare CTO Dane Knecht said on October 21 that the company was “seeing early attacks emerging” and had deployed WAF rules for the known exploit vectors to all customers, including the free tier. Knecht described the rules as a stopgap: “Patch as soon as @ThePHPF releases the update at 14:00 UTC today.” Those rules only cover traffic routed through Cloudflare.
Tenable adds that watchTowr says it believes it has reproduced CVE-2026-109618, that code claiming to exploit the flaws is circulating, and that Tenable has not verified any of it works. Tenable also warns that unverified exploit code is sometimes laced with malware, so defenders who download anything labelled as a proof of concept to test their estate take on their own risk.
One suggested workaround was a PHP configuration change. PHP core developer Gina Peter Banyard answered that “the only mitigation is patching / upgrading PHP.” Tenable quotes release manager Joe Ferguson saying “ini settings won’t save you.” The NCSC alert and the CERT-EU advisory list no configuration workaround.
How much of the internet this touches
Tenable cites W3Techs for PHP running on 69.3% of websites whose server-side language is known. It also cites researcher Silas Cutler’s rough estimate of more than 1.3 million potentially vulnerable internet-exposed hosts, and a Shodan search by Henk Poley counting more than 1.9 million internet-exposed hosts running PHP. Those are two researchers’ estimates, and they differ because they count different things.
PHP has a record in CISA’s Known Exploited Vulnerabilities catalog. Tenable lists three PHP entries, and says two of them, CVE-2024-4577 and CVE-2019-11043, are known to have been used in ransomware campaigns.
What it means for the security leader
Tenable names WordPress, Drupal, Joomla, Laravel and Magento as platforms that run on PHP, and the NCSC points to appliances and services that may bundle it. In our reading, the first hour of this release will be spent on an inventory question, and the teams that answer it quickly will be the ones that kept an exposure list current before the notice. We made that case in An Exposure Inventory Decides Your First Hour After an Advisory, and the PHP notice is a live test of it. The patch clock itself is worth setting from the release, a point we argued in Start the Patch Clock on Release Day, Not Advisory Day.
What defenders should do now
Build the list of PHP systems today, internet-facing first, and include vendor appliances and hosted products that bundle PHP. Mark each as supported 8.x, end-of-life, or vendor-managed. Stage the upgrade for the supported group so it can start when the official release lands, and read the fixed versions from php.net, since the numbers above come from pre-release reporting. For end-of-life systems, decide between isolation behind access controls and taking them offline, as the NCSC and CERT-EU describe. Watch web server logs on exposed PHP applications for unusual requests, and restart or redeploy after patching so running processes pick up the fixed binaries. Tenable lists plugins 48243 and 58987 for PHP version detection and unsupported-version detection for teams that scan with its products.
