Cloudflare Sees Attack Traffic Targeting Critical PHP Flaws

Cloudflare observed attack traffic targeting two critical PHP flaws as details circulated ahead of the fixes.

The company enabled default protections for customers using its web application firewall at 11:02 p.m. ET on Oct. 20 (03:02 UTC on Oct. 21). Installing a fixed PHP version remains the complete remedy.

PHP released fixes on Oct. 21 for CVE-2026-109618 and CVE-2026-109619. Each flaw has a critical severity score of 9.2 under version 4.0 of the Common Vulnerability Scoring System. The vulnerabilities can let someone run code on an affected web server without logging in.

In controlled tests, researchers demonstrated code execution on servers hosting WordPress, Drupal and Joomla. They also showed that the flaws could expose passwords, tokens and API keys stored in a PHP process’s memory. Those tests do not establish that live sites were compromised. At the time of release, the PHP security team had found no functional exploits in the wild.

The flaws were examined in separate AI-assisted investigations. Calif used OpenAI’s GPT-5.6 Sol, while Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.

PHP appeared on 69.3% of websites whose server-side programming language could be identified in an Oct. 22 survey. That share does not show how many sites have an affected, unpatched version of PHP. Exposure for a crypto service depends on the software running on its own web infrastructure.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive normal project updates; operators using them need to check for a vendor patch, an applicable source backport or an upgrade. Updating a website plugin alone does not repair the PHP runtime.