PHP Releases Fixes for Two Critical Flaws as Cloudflare Adds WAF Protections

Attack traffic targeted two critical PHP vulnerabilities, but the activity does not confirm server compromises and operators still need to install available fixes on vulnerable systems.

The flaws, CVE-2026-109618 and CVE-2026-109619, can enable remote code execution without authentication, expose data or interrupt services.

Web-facing PHP deployments are vulnerable, especially those running Apache’s mod_php.

By 11:02 p.m. ET Oct. 20 (03:02 UTC Oct. 21), Cloudflare’s default WAF safeguards covered customers on free or paid WAF plans. Attackers changed payloads to try to evade the rules. Operators still need to install PHP updates.

Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The PHP project no longer supports version 8.1 or earlier, although some vendors may still issue patches for those versions.