PHP patches critical RCE flaws as exploit attempts surge

PHP released an out-of-cycle security update at 14:00 UTC on October 21 to address two critical vulnerabilities. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 on the CVSS v4.0 scale. They allow unauthenticated remote code execution on systems serving web requests. The affected versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The issues impact PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed installations.

The first vulnerability involves out-of-memory handling interrupting PHP while internal request data is partially initialized. The second involves request-owned internal state surviving after its backing memory has been freed. Researchers at Wiz and OpenAI found and reported the flaws. The vulnerabilities affect nearly every PHP version back to PHP 5.4. The risk is considered highest for servers using Apache's mod_php due to a demonstrated exploit.

Amazon's Threat Intelligence team detected an exploit attempt on October 17, 2026, four days before public disclosure. The attempt originated from an IP address associated with a commercial anonymization network. Cloudflare recorded millions of exploitation attempts. Cloudflare CEO Matthew Prince reported thousands of attempts in the 10 hours before disclosure, jumping to tens of thousands within 45 minutes. Threat actors have been observed unsuccessfully attempting to deploy a Mirai botnet variant called Potassium. The malware checks for an HTTP 200 response status and verifies that the resulting payload begins with the ELF magic bytes 7F 45 4C 46. Researchers developed a new exploit showing that Address Space Layout Randomization cannot stop the PHP2Shell vulnerability.

Cloudflare implemented web application firewall rules at 3:02 am UTC to protect websites from attack traffic. Government websites in Finland, the Netherlands, and France went offline as a precaution after details leaked early.