National Security Agency Urges Offline PHP Systems If Updates Aren’t Feasible

The National Security Agency (NSA) urged organizations unable to update affected PHP servers immediately to take them offline until mitigation is complete, after Cloudflare observed attack traffic targeting customers before Oct. 21 fixes.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let attackers execute code remotely without authentication on affected web servers. One involves remote code execution through out-of-memory corruption; the other can leave stale internal state available between requests. Each received a 9.2 score under version 4.0 of the Common Vulnerability Scoring System (CVSS), placing both in the critical range. Exploit reliability can vary by PHP build and server setup.

PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Affected installations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerabilities are in PHP itself, so they are not limited to any particular hosted application. The releases extend earlier coverage of the PHP flaws affecting web servers.

Cloudflare’s web application firewall protections for customers were active by 11:02 p.m. ET Tuesday, Oct. 20 (03:02 UTC Wednesday, Oct. 21). That was 10 hours, 58 minutes before PHP’s scheduled 10 a.m. ET release Wednesday (14:00 UTC). The NSA also called for immediate patching across U.S. government departments and agencies.

No complete workaround is available; updating is the only safe resolution. PHP 8.1 and older no longer receive updates from the project. It provided source backports for versions 7.4, 8.0 and 8.1, and directs users to check with their software distribution or long-term support vendor for packages.

PHP appeared on 69.3% of websites with an identified server-side programming language as of Oct. 22. That measure excludes sites where the language could not be identified, and it does not show how many websites are vulnerable.