SECURITY researchers tracked a rapid surge of exploitation activity targeting two critical PHP RCE flaws, now tracked as CVE-2026-109618 and CVE-2026-109619, with patches released on 21 October after an embargo and weeks of coordinated disclosure. Initial probing reportedly began on 17 October, four days before fixes, with mass exploitation following the public patch release.
Evidence from Amazon, Cloudflare and other researchers shows a burst of PoC exploits circulating as soon as the embargo lifted, including PoCs observed across anonymised infrastructure and honeypots. While some early PoCs did not achieve remote code execution, rapid amplification and multiple actor involvement were evident.
From the data shared by Amazon, WatchTowr, VulnCheck, VirusTotal and Censys, more than a million PHP installations were vulnerably exposed as of 21 October, including large shares of end‑of‑life versions (e.g., PHP 5.x through 7.3) and many unpatched or legacy deployments. The US hosts dominate the affected landscape, though remediating remains feasible where providers like AWS, DigitalOcean, Alibaba, OVHcloud and Hetzner host the vulnerable instances.
The security community described the situation as a potential major impact similar in spirit to Log4Shell, given the scale and the difficulty of identifying every affected system.
CISA urged immediate patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, emphasising that organisations must also locate forgotten or shadowed installations and assets. In the meantime, defenders were advised to apply strict human‑friendly controls—harden web-facing processes, limit what they can launch or access, and push WAF rules as a stopgap while full remediation proceeds.