Critical PHP security vulnerabilities: How to fix them

PHP.net confirmed two remote code execution (RCE) flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, both rated at a critical 9.2 CVSS v4.0 score, which is critical.

The vulnerabilities reportedly affect all builds from PHP 5.4 up to PHP 8.

Active exploitation in the wild has been confirmed as reported by Cloudflare and security researchers.

Information and a proof of concept (referred to as PHP2Shell) were leaked online prior to the scheduled fix, prompting attackers to actively probe servers for exploit vectors

PHP is widely used across the big domains of the internet. Speculations have been making rounds on the internet that the websites which are using this software could be severely susceptible to cyber breaches.

Patch timeline

Details leaked ahead of schedule, forcing the PHP security team to advance the official patch release date to October 21, 2026.

Hence the emergency patch will be released on October 21 at 14:00 UTC / 16:00 CEST / 10:00 EDT / 07:00 PT. Aikido is working on releasing pre-patched base images to streamline deployment without requiring broad application upgrades.

Fixed versions will also be released alongside full technical details. The official patches are only provided for supported versions such PHP 8.2 and newer. The older versions including PHP 8.1, PHP 7 and PHP 5 will not get an official PHP core patch.

Recommended fixes and measures

It is useless to change the configuration as previous workarounds and current WAF rules do not offer protection.

If possible, remove internet-facing PHP applications from the public web until official patches are applied. The moment patches are published, one must immediately apply PHP security updates.

For compromise auditing, perform post-patch forensics covering logs back to June 2026 and look for Web shells and unexpected/modified files, newly created unauthorized admin users and anomalous outbound connections.