PHP Fixes Two Critical Flaws That Put Web Servers at Risk

PHP maintainers released fixes Oct. 21 for two critical flaws that could let attackers without credentials run code on servers handling web requests, putting crypto services that use vulnerable PHP at risk.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a CVSS v4.0 score of 9.2. Risk is highest on Apache servers using mod_php, where an unauthenticated request can reach PHP before application code runs. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Cloudflare observed attack traffic targeting its customers before public disclosure. The PHP Foundation had not identified a functional exploit by release time. No crypto exchange, wallet or blockchain service was identified as a victim.

PHP is used by 69.3% of websites whose server-side language is known; that figure does not show how many sites are vulnerable. The PHP security team urged users to update immediately. The National Security Agency advised organizations unable to update at once to take affected systems offline until they are mitigated.