On 21 Oct 2026, the PHP Foundation released emergency patches for two critical memory-safety vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619. These severe flaws allow unauthenticated remote code execution and memory disclosure on any PHP installation serving web requests. Both vulnerabilities stem from use-after-free conditions triggered by out-of-memory errors. According to the PHP Foundation, the issues carry a CVSS score of 9.2 and can be exploited without knowing the target application or specific software version.

Technical Scope and Early Exploitation

The vulnerabilities affect all PHP releases from version 5.4 onward. However, the PHP Foundation noted that only PHP 8.2 and newer remain officially supported to receive direct patches. Security vendors including Wiz, Cloudflare, and Sansec reported early exploitation attempts surrounding the disclosure, warning that mass automated attacks could begin almost immediately. Wiz researchers utilized AI tools to discover and successfully exploit the vulnerabilities, generating an exploit chain dubbed php2shell.

In addition to remote code execution, the UK National Cyber Security Centre highlighted that the flaws allow attackers to read sensitive process memory, including hardcoded passwords and active API keys. Because the mechanism relies on memory corruption during out-of-memory states, standard web application firewalls may not provide complete protection without underlying code remediation.

The urgency of the response has prompted international cybersecurity authorities to issue direct warnings to network administrators. Organizations operating web infrastructure face a narrow window to inventory and secure vulnerable endpoints before automated exploitation scales across the internet.

Prior to the public rollout, the PHP Foundation issued a pre-release notice warning that the CVEs were classified as critical Wired. The organization indicated that an earlier release could occur if tangible exploitation evidence emerged Wired. This proactive warning aimed to prepare administrators given the severe risk profile associated with memory-safety flaws impacting legacy and modern web servers alike.

Because unsupported versions like PHP 5.4 and older iterations will not receive official patches, organizations running legacy environments face acute risks. Security researchers at Wiz demonstrated that automated tooling can rapidly operationalize these memory-corruption vectors into viable attack chains, underscoring why isolating legacy systems remains a core pillar of official remediation directives.

Mitigation Guidance and Official Response

The UK National Cyber Security Centre advised organisations to immediately identify all PHP deployments across their networks, apply the latest emergency patches, and consider temporary mitigations where updates cannot be deployed instantly NCSC. Where patching is not immediately feasible, the agency recommended taking affected systems offline to prevent unauthorized compromise NCSC.

Security advisories also urged administrators to monitor systems closely for evidence of compromise and review access logs for suspicious activity NCSC. The PHP Foundation and participating security vendors continue to track widespread scanning and exploitation attempts following the public release of the emergency patches Wiz.