# PHP RCE Flaws CVE-2026-109618/109619 Actively Exploited

> Critical remote code execution flaws in PHP (CVE-2026-109618, CVE-2026-109619) are under active, widespread exploitation, impacting millions of web properties.

- Published: 2026-11-01T03:16:10.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: PHP, Remote Code Execution, Zero-Day, CVE-2026-109618, CVE-2026-109619
- CVEs: CVE-2026-109618 (CVSS 9.8), CVE-2026-109619 (CVSS 9.8)
- Author: Runtime Rebel Intel
- Primary source: https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
- Canonical: https://runtimerebel.com/blog/php-rce-flaws-cve-2026-109618-109619-actively-exploited

## Key points

- Immediate impact: Millions of websites face outages and full server compromise due to actively exploited PHP vulnerabilities.
- Affected systems: All web servers running PHP 5.4 or later are vulnerable to these critical remote code execution bugs.
- Remediation: Immediately update all PHP installations to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35 to patch the flaws.

## Critical PHP [RCE](/glossary#rce) Flaws Under Widespread Exploitation

A pair of critical remote code execution (RCE) vulnerabilities in PHP, identified as [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) and [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619), are being actively exploited in the wild. These flaws allow attackers to gain full control over affected servers, leading to widespread website outages and potential data exposure. Security experts consider this one of the most impactful security issues in recent memory due to PHP's pervasive use across the internet, powering web publishing systems like Drupal, Magento, Joomla, and WordPress.

### Technical Details of PHP 5.4 or Later Critical Vulnerabilities

The vulnerabilities affect all versions of PHP 5.4 and later, encompassing nearly every PHP release from the last decade, as highlighted by researchers at Wiz. The underlying flaws have existed for decades but their exploitability required exceptionally complex steps, with frontier [AI](/glossary#ai) models significantly lowering the barrier to weaponization. PHP released emergency security updates (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address these critical bugs.

Cloudflare has already detected exploitation attempts and implemented web application [firewall](/glossary#firewall) ([WAF](/glossary#waf)) rules to protect websites, noting that the flaws could lead to denial-of-service conditions, remote code execution, and data exposure. Reports from Reuters indicate that government websites in Europe and elsewhere have gone offline following the disclosure. Cybersecurity firm Censys identified approximately 2.58 million internet-facing hosts and 54.9 million web properties running PHP, underscoring the potential scale of impact.

Wiz researchers predict these PHP vulnerabilities will be mass-exploited to install web-based backdoors or "web shells," granting attackers remote control over infected sites. The severity and widespread nature of these RCE flaws draw comparisons to the Log4Shell [vulnerability](/glossary#vulnerability) that emerged in 2021, emphasizing the extensive efforts required across the ecosystem to reduce exposure before technical details became public.

The discovery and coordinated disclosure of these vulnerabilities involved several organizations, including OpenAI, Wiz, and Calif, working with the PHP team to measure the problem's scope and verify patches prior to public release, according to [KrebsonSecurity](https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/). Ubuntu has already begun shipping updated PHP packages to address these flaws.

### Actionable Recommendations for Mitigating PHP RCE Flaws

Given the confirmed active exploitation and the critical nature of these vulnerabilities, immediate action is paramount for any organization running PHP. Successfully patching PHP [CVE](/glossary#cve)-2026-109618 and CVE-2026-109619 should be the highest priority.

*   **Prioritize Patching**: Update all PHP installations to the latest patched versions as soon as possible:
    *   PHP 8.5.12
    *   PHP 8.4.27
    *   PHP 8.3.36
    *   PHP 8.2.35
*   **Review WAF Rules**: Ensure Web Application Firewalls (WAFs) are updated with the latest rules to detect and block exploitation attempts. Cloudflare has already implemented protections, and other WAF providers are expected to follow suit.
*   **Monitor for Web Shells**: Actively monitor web servers for indicators of compromise, particularly the presence of unexpected files or processes that could indicate web shells or other backdoors.
*   **Vulnerability Scanning**: Conduct regular vulnerability scans to identify any unpatched PHP instances across your infrastructure.
*   **System [Hardening](/glossary#hardening)**: Implement or review general web server hardening best practices, including principle of [least privilege](/glossary#least-privilege), strict access controls, and regular security audits.

**Related:** [MikroTik RouterOS Unauthenticated SSH Exploit: Critical Advisory](/blog/mikrotik-routeros-unauthenticated-ssh-exploit-critical-advisory), [Metabase Zero-Day SQL Vulnerability Threatens Analytics Platforms](/blog/metabase-zero-day-sql-vulnerability-threatens-analytics-platforms)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/php-rce-flaws-cve-2026-109618-109619-actively-exploited