.svg)
PHP powers an estimated 69% of all websites on the internet. Any critical security flaw in the scripting language a widespread problem, and right now there are two of them. CVE-2026-109618 and CVE-2026-109619 are both remote code execution vulnerabilities confirmed by PHP.net on October 21, 2026, with security researchers warning that exploitation is easy, requires no authentication, and that attackers are already scanning for vulnerable targets.
The timing makes this particularly urgent. A proof of concept was publicly released before the official patch became available, giving attackers a head start. Oliver Spence, CEO of CybaVerse, noted that because details around the vulnerabilities leaked early, "attackers will be focusing their efforts on PHP knowing there are two critical CVEs that allow RCE, which could enable them to launch further attacks and potentially ransomware." That is not a theoretical concern. It is the current situation.
Both CVEs affect PHP versions 5 through 8, though the patch coverage is uneven. PHP 8.2 and newer have fixes available, specifically versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP versions 5.4 through 8.1 are end-of-life and will not receive a patch for either vulnerability. Daniel Wilcock, threat intelligence analyst at Talion, put the exposure plainly: "Many web servers, e-commerce platforms or CMSs using PHP are going to be exposed as a target," and organizations are in a race to apply the patch before attackers get there first.
The Older the PHP Version, the Bigger the Problem
The Detectify Security Research team identified what may be the most significant risk factor in this situation: the sites running older, unpatched PHP versions are typically the ones nobody is actively watching. "The oldest versions matter most because they won't be fixed," the team warned. "Those sites haven't been updated in years, which usually means nobody is watching them either." For businesses running legacy PHP applications, particularly older content management systems, e-commerce platforms, or custom-built web tools, this vulnerability represents a direct and credible threat with no available upstream fix.
For organizations running PHP workloads on AWS, the bulletin adds a service-specific layer of urgency. Elastic Beanstalk customers who have not enabled Managed Platform Updates need to update their environment manually. Amazon Lightsail users must create new instances from updated blueprints entirely, since AWS cannot update running Lightsail instances in place. Amazon Linux users should apply the updated PHP packages immediately through the Amazon Linux Security Center.
Businesses that cannot patch immediately can use AWS WAF compensating controls as a temporary measure, including the SizeRestrictions_BODY rule for CVE-2026-109618 and AWS's newly released PHP Managed Rule Group version 2.3 for CVE-2026-109619. These reduce exposure but are not substitutes for patching.
The core message from every security researcher commenting on this situation is consistent: patch now, patch quickly, and if your PHP version is end-of-life, treat migration to a supported branch as an immediate priority rather than a future project. With attackers already probing for vulnerable sites, the window for a comfortable, scheduled remediation has already closed.
If your business runs a website, web application, or any customer-facing platform built on PHP and you are unsure whether your environment is patched or exposed, it is important to start by reaching out to your web developer.
If you are concerned that PHP vulnerabilities have impacted your business, contact InfoPathways for a free exploratory session. We work with businesses across Maryland to manage their IT infrastructure, monitor for vulnerabilities, and respond quickly when critical threats emerge. InfoPathways can use threat exposure visibility tools like NordStellar to see if you have been exposed, and help build the right remediation plan for you.