PHP Prepares Emergency Fix as Cloudflare Reports Early Attacks on Critical Flaws
Do Son 
TL;DR
The PHP team will ship a security release on October 21, 2026, at 14:00 UTC to fix two critical flaws rated CVSS v4.0 9.2. Leaks tie them to CVE-2026-109618 and CVE-2026-109619, described as remote code execution bugs in PHP core. Admins should prepare to patch the moment this PHP security release lands.
Why It Matters
PHP runs WordPress, Drupal, Magento and most shared hosting. A core flaw could therefore reach a huge share of the web. Mallory counted about 1.5 million internet-facing hosts that report a PHP version. Of those, 59% run PHP 8.1 or older, branches that no longer get official fixes.
A leak forced the early warning
On October 20, an anonymous Hacker News post claimed two PHP flaws rated CVSS 10.0. Soon after, Kevin Beaumont wrote on Mastodon that “somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.” In addition, watchTowr said on X that the flaws are real.
The same day, PHP posted an advance notice of the PHP security release. It reads: “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.”
How the Attack Works
No technical details are public yet. PHP says that “full details, affected versions, and the fixed versions will be published with the release.” The leaks describe remote code execution, but PHP’s notice itself does not name the bug type.
Exploitation status
Cloudflare reports early attacks against these flaws, and unverified PoC code is circulating. PHP has not yet confirmed exploitation, and the flaws are not in CISA’s KEV catalog.
php2shell
Tomorrow is a helluva day. pic.twitter.com/M8ybQcrnlu
— Kirill Firsov (@k_firsov) October 20, 2026
Affected Versions
PHP has not named affected versions. Leaked claims say every release from PHP 5 onward is affected, but these remain unverified.
Patch and Mitigation Steps
- Inventory every PHP-based application and its version.
- Install the fixed releases as soon as PHP publishes them.
- Plan upgrades for servers on PHP 8.1 or older.
- The widely circulated interim mitigation is to disable the upload-progress feature: session.upload_progress.enabled = Off
- Block multipart/form-data requests on routes that do not require uploads as well.
- Consider isolating internet-facing PHP apps until patched.
- Look for PHP files created or modified around the disclosure window, odd files in upload and cache directories, and web-shell signatures:
With details likely to follow the PHP security release, attackers may move fast. Teams should patch within hours, not days.
Cloudflare Reports Early Attacks
The threat is no longer only theoretical. Dane Knecht, CTO of Cloudflare, said on X that attacks have started. “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” he wrote.
In response, Cloudflare has pushed protective firewall rules to its network. “PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities,” Knecht said. He added that “the rules are available to all customers, including free.”
Meanwhile, The Stack reports that “various POC exploits are circulating,” though most appear low quality. CERT-EU has also urged immediate patching, or isolating internet-facing PHP apps where that is not possible.
What this means for defenders
A firewall rule buys time, but it is not a fix. Attackers often find new ways around early filters. Therefore, admins should apply the PHP security release as soon as it ships. Until then, keep exposed PHP apps behind a web application firewall and watch logs for unusual requests.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
