Global – October 29, 2026 -- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and let unauthenticated attackers run code on web servers. Cyber insurer Coalition says its honeypots recorded exploit-related requests more than five hours before PHP released its fix, and it expects exploitation at scale.
PHP published its advisory on October 21, a day earlier than planned after details leaked online. The flaws sit in PHP itself rather than in any single application. Attackers can also read passwords, authentication tokens, API keys and certificates from server memory without taking over the server.
Affected code dates to PHP 5.4, released in 2012
Wiz Research found the flaws in collaboration with Calif and OpenAI. CVE-2026-109618 is a remote code execution (RCE) flaw caused by how PHP handles running out of memory. CVE-2026-109619 is an RCE caused by leftover data from one web request being reused by the next. Effectively every version in use today is vulnerable.
PHP says all installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates Apache with mod_php highest, where it has demonstrated a working exploit. Neither CVE was on CISA's Known Exploited Vulnerabilities list at the time of writing.
Coalition honeypots logged probing at 38 times the normal hourly rate
The first exploit-related requests reached Coalition's sensors at 08:00 UTC on October 21, more than five hours before the patch. Some referenced "p2shell," the name of exploit tools now circulating online.
Between 12:00 and 13:00 UTC, requests for phpinfo pages jumped to 3,839, against about 100 in a typical hour. Exposed phpinfo pages reveal a server's exact PHP version and configuration, which attackers use to pick targets.
In the three hours after release, Coalition logged 133 requests abusing the upload-progress feature the attacks rely on, versus 28 in the hours before. About 2.5 hours after release, it saw the first requests built to trigger the out-of-memory flaw behind CVE-2026-109618. Coalition describes the volumes as still small, which is typical in the first hours after disclosure.
PHP runs 69.3% of sites with a known server-side language
WordPress, which runs on PHP, accounts for 39.6% of all websites. Coalition expects hosting providers to roll out patched builds for most WordPress sites, which rarely hold critical data and can usually be restored quickly. It sees the larger risk in everything else built on PHP.
Exposure spans every PHP branch. A meaningful share of vulnerable assets run end-of-life versions, 8.1 and older, which will not receive an official fix.
Admin tools holding credentials and backups are the priority targets
PHP also powers admin interfaces for critical systems. Coalition lists phpMyAdmin and Adminer for databases, pfSense and OPNsense for firewalls, Bacula-Web and Bareos WebUI for backups, Zabbix, Nagios XI and GLPI for monitoring and asset management, and FreePBX for phone systems. Attackers who reach backups can destroy or encrypt them, which makes ransomware far more damaging.
Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Coalition advises updating to those versions or later, then restarting PHP-FPM or the web server. Distribution and hosting-provider packages may use different version numbers, so confirm the fix with the vendor. Systems on PHP 8.1 and older should be taken off the internet until upgraded or backported.
Where patching is not immediate, Coalition recommends placing PHP applications behind a web application firewall. Cloudflare, Akamai, AWS, Fastly and Google Cloud have prepared protections. Temporary settings include session.upload_progress.enabled=0, a non-overridable memory_limit=-1 with post_max_size kept at 8M (or 32M if uploads are needed), and fatal_error_backtraces=0 on PHP 8.5. Coalition notes these settings reduce risk but do not fix the flaws.
Because the attack happens below the application layer, app logs may show little. Wiz advises watching for file uploads followed by out-of-memory errors or runs of HTTP 500 errors, oversized or garbled PHPSESSID cookies, and PHP workers that repeatedly crash or restart.
Coalition sent a Zero-Day Alert to some policyholders on October 20, before public disclosure, and to all policyholders with internet-exposed PHP on October 21.