# PHP Releases Fixes for Two Critical Flaws as Cloudflare Adds WAF Protections

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/38071
Published: 2026-10-22T16:18:52.000Z
Updated: 2026-10-22T16:18:52.000Z
Section: Technology

> The fixes cover PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive project updates.

Attack traffic targeted two critical PHP vulnerabilities, but the activity does not confirm server compromises and operators still need to install available fixes on vulnerable systems.

The flaws, CVE-2026-109618 and CVE-2026-109619, can enable remote code execution without authentication, expose data or interrupt services.

Web-facing PHP deployments are vulnerable, especially those running Apache’s mod_php.

By 11:02 p.m. ET Oct. 20 (03:02 UTC Oct. 21), Cloudflare’s [default WAF safeguards](<https://www.tokenpost.com/news/technology/37647>) covered customers on free or paid WAF plans. Attackers changed payloads to try to evade the rules. Operators still need to install PHP updates.

Fixed releases include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The PHP project no longer supports version 8.1 or earlier, although some vendors may still issue patches for those versions.



## Links in this article

- [default WAF safeguards](https://www.tokenpost.com/news/technology/37647)