PHP Vulnerability CVE-2026-109618: EU Warns Unpatched Websites May Need to Go Offline
Two critical PHP vulnerabilities could expose websites to remote code execution. CERT-EU urges site operators to prepare for patches and isolate systems if needed.
- Published
- Reading time
- 5 minutes
A security warning over two critical PHP vulnerabilities has put website owners and hosting providers on notice: systems that cannot be patched quickly may need to be temporarily isolated from the internet. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 and could potentially allow unauthenticated remote code execution.
PHP’s developers had scheduled a security release for 14:00 UTC on October 21 and urged users to upgrade as soon as it became available. At the time of this report, the PHP team had not published technical details or confirmed which versions would be fixed. Check the official PHP security notice before publishing for the latest release status and version information.
What are CVE-2026-109618 and CVE-2026-109619?
The two CVE identifiers refer to separate flaws in PHP, a programming language used to run code on web servers. CERT-EU says the vulnerabilities could lead to remote code execution, meaning an attacker might be able to run code on an affected system without first logging in. The agency notes that the score indicates this potential risk; detailed technical information had not yet been made public.
CERT-EU said the vulnerabilities could affect PHP versions from PHP 5 onward, but PHP had not confirmed the affected version range at the time of its advisory. Site operators should therefore rely on the PHP team’s release notes and their hosting provider’s guidance to determine which systems need updating.
Why the warning could affect so many websites
PHP runs behind a wide range of websites and services, including sites built with WordPress, Drupal, Joomla and Magento. It is also used by shared hosting platforms and applications that may not make their PHP dependency obvious to site owners.
That means the issue is not limited to a particular website builder or content management system. The PHP runtime installed on the server may need an update even if the site’s themes, plugins or CMS are already current.
CERT-EU is advising organisations to prepare to patch affected systems immediately once fixes are available. If an organisation cannot apply a fix promptly, it says internet-facing applications should be considered for isolation from public networks until they can be secured. That is risk-based guidance for vulnerable systems, not a blanket instruction for every PHP website to shut down.
⚠️ UPDATE: PRE-PATCH STOPGAP FOR TWO CRITICAL PHP RCE FLAWS (CVE-2026-109618 / CVE-2026-109619) PHP's emergency release for two vulnerabilities, both rated CVSS v4.0 9.2, is scheduled for today, Oct 21 at 14:00 UTC (10:00 a.m. ET). PHP has published NO technical details, affected versions or fixed versions yet, and reserves the right to ship earlier if details leak or exploitation appears. What's confirmed: • Two critical flaws, both CVSS v4.0 9.2, patches due Oct 21 14:00 UTC • https://t.co/f3RM1LL3h0 has withheld all technical detail until release; mainstream reporting notes the CVEs are real and may reach back to PHP 5 Unconfirmed researcher assessment (their own read of php-src, moderate confidence): • Likely path is session.upload_progress / multipart rfc1867 handling (php_session_rfc1867_callback) — present since PHP 5.4, on by default, reachable before authentication • A quoted post claims two heap use-after-free bugs there were recreated in a lab. Treat the root cause and the recreation claim as unverified until PHP's advisory confirms them. ⚠️ Analyst Note (stopgap you can apply now, low-risk and reversible): • Set session.upload_progress.enabled = Off in php.ini / .user.ini, then reload PHP-FPM or your web server. By the researchers' own read this may close only one of the two likely paths. • Tighten WAF or reverse-proxy inspection of, or rate-limit, multipart/form-data POSTs to endpoints that don't need uploads — the second likely path runs for any multipart POST regardless of the setting. • Inventory every PHP host now and patch the moment the release lands. PHP 7.x and older are end-of-life and will NOT get a fix — plan to upgrade. No proof-of-concept or exploit detail is being shared. No active attacks have been established. Credit to researchers @J4ck3LSyN, @acd421 and @ArchKnight23 for the early mitigation guidance. Primary: jackalsyn[.]com · https://t.co/f3RM1LL3h0 · arstechnica[.]com #PHP #CVE #RCE #CyberSecurity #ThreatIntelligence #PatchNow #DDW #DarkWeb
— Dark Web Intelligence (@DailyDarkWeb) October 21, 2026
Are attackers already exploiting the PHP vulnerabilities?
Security warnings describe differing assessments of the immediate threat. Cloudflare’s chief technology officer said the company was seeing early attacks and was updating firewall mitigations, while stressing that those measures were only a stopgap. Australia’s cyber agency, meanwhile, said it was not aware of active exploitation at the time of its notice.
These statements do not establish that every vulnerable site is under attack. They do underline why site operators should identify their PHP systems, prepare to install the official fix and avoid treating temporary firewall protections as a substitute for patching.
What website owners should do now
Website owners and administrators can begin by asking their hosting provider or technical team which PHP version runs on each site and who is responsible for updating it. WordPress users should not assume that updating WordPress itself will update PHP: the software and the server runtime are separate components.
Once PHP publishes the fixed releases and affected-version list, administrators should apply the relevant update as soon as their hosting setup allows, then confirm that the live server is running the patched version. If immediate patching is not possible, follow CERT-EU’s advice to assess whether the exposed application should be isolated until a fix can be installed.
For businesses that depend on online services, the priority is to establish what is running PHP, who manages it and how quickly updates can be deployed. The vulnerability warning is a reminder that a routine CMS update may not cover the underlying software powering the site.
Questions readers ask
What is CVE-2026-109618?
CVE-2026-109618 is one of two critical PHP vulnerabilities announced ahead of a scheduled security release. CERT-EU says the flaws could potentially allow unauthenticated remote code execution.
Is CVE-2026-109619 part of the same warning?
Yes. The PHP security warning covers CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 on the CVSS v4.0 severity scale.
Which PHP versions are affected?
CERT-EU said versions from PHP 5 onward could be affected, but PHP had not confirmed the final affected-version range at the time of the advisory. Check the official PHP release notes for the confirmed list.
Do WordPress automatic updates install the PHP security patch?
Not necessarily. WordPress and PHP are separate components: the PHP runtime is managed through the server or hosting provider. Site owners should ask their host or administrator whether the server has been patched.
Do all websites using PHP need to go offline?
No blanket shutdown was announced. CERT-EU advised organisations that cannot patch promptly to consider isolating affected internet-facing applications until a fix is available. Each operator should assess its exposure and follow its security team’s guidance.
Has the PHP vulnerability been actively exploited?
Cloudflare reported seeing early attack activity, while Australia’s cyber agency said it was not aware of active exploitation at the time of its notice. These reports describe different observations and do not confirm that every vulnerable site is being targeted.
