SECURITYWEEK reports a coordinated industry and government response to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The bugs were identified by Wiz, OpenAI and Calif in August, with PHP releasing patches on 21 October for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35—one day after the disclosure identifiers circulated online.
Exploitation began before and around the patch window: Amazon detected an initial attempt on 17 October, with other researchers and services observing attacks in the hours leading up to, and just after, the fixes. Some PoCs did not achieve code execution, but mass exploitation followed once patches appeared. Because PHP is embedded across many products and services, numerous vendors are auditing exposure and applying mitigations.
The article lists a wide set of affected and defended assets, including Cisco’s advisory on more than 30 products under review (noting no confirmed affected products so far), Red Hat’s risk assessment, and Ubuntu and Debian patches for supported releases. Cloud providers and hosting platforms are updating runtimes and base images, while cPanel, Plesk and DirectAdmin issued fixes for PHP variants.
Security firms have rolled out detections and mitigations: Palo Alto Networks published interim workarounds, Fortinet found most products unaffected, CrowdStrike confirmed a single unauthenticated POST request can trigger a shell in Apache mod_php, and Corelight and others posted open-source detections. Governments urged immediate patching; CISA, the UK’s NCSC, the Dutch NCSC, CERT-EU, ENISA, and national bodies in Canada and Germany issued alerts. Some sites reportedly went offline as a precaution.