The 30-Second Brief
- Source report PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. [1]
- Analysis This is an emergency runtime change, not a wait-for-the-next-application-release issue: PHP says there is no complete mitigation and updating is the only safe choice.
What Changed
Source report PHP shipped coordinated security releases for every supported production branch: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The project rates both issues critical and says each can lead to unauthenticated remote code execution. PHP 8.2 is still receiving this fix, but its support ends on December 31, 2026. [1]
Source report CISA separately told organizations to update immediately and described the affected surface as PHP 5.4 and later. [2] Cloudflare says it deployed managed WAF rules before disclosure, but that is a traffic-layer control rather than a replacement for a fixed runtime. [3]
Why It Matters
Analysis PHP often sits beneath CMSs, commerce applications, control panels and custom APIs. That makes the runtime inventory wider than the list of teams that identify as PHP developers. Container base images, managed hosting plans, appliance bundles and long-lived virtual machines all need separate confirmation.
Wiz demonstrated pre-authentication code execution against representative WordPress, Drupal and Joomla deployments, but stressed that the vulnerable code is in PHP itself rather than those applications. [4] The operational consequence is important: a clean plugin list or fully updated CMS does not establish that the underlying interpreter is safe.
Evidence & Uncertainty
The fixed versions and the project’s “no complete mitigations” statement are direct PHP claims. Researcher demonstrations establish technical feasibility, not the prevalence of exploitation in the wild. None of the primary sources reviewed here provided evidence of broad active exploitation as of the source check. Teams should therefore patch urgently without treating every exposed PHP host as already compromised.
Cloudflare’s managed rules may reduce exposure for traffic that actually passes through its WAF, but coverage depends on product tier, rule deployment and whether attackers can reach an origin directly. Post-patch review should include workers that handled suspicious multipart uploads, unexplained crashes, memory errors or new outbound connections.
Story Timeline
- October 20: PHP gave advance notice of two CVSS 9.2 critical fixes.
- October 21, 14:00 UTC: Supported PHP branches received patched releases and technical details were disclosed.
- October 22: Defenders should be separating “patched,” “temporarily shielded,” and “still unknown” assets rather than reporting one blended completion percentage.
Action Center
Selections remain in this browser.
Evidence Explorer
What is confirmed?
PHP and CISA identify two critical vulnerabilities that can allow unauthenticated remote code execution, and PHP has released fixes across supported branches.
What did researchers demonstrate?
Wiz reports pre-authentication RCE on representative WordPress, Drupal and Joomla deployments plus process-memory disclosure. These are demonstrations, not a measurement of real-world exploitation.
What remains uncertain?
The public sources reviewed do not quantify active exploitation, vulnerable asset counts or the effectiveness of every third-party mitigation.
What would change the priority?
Evidence of exploitation, direct origin exposure or inability to identify the running PHP version should trigger immediate incident-response escalation.
Sources & Transparency
Last source check: . Primary-source facts were checked against PHP and CISA; researcher and provider claims are attributed separately.