Two critical vulnerabilities in PHP have alarmed security researchers and website operators because they permit remote code execution on vulnerable servers. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team says it will publish technical details and fixes alongside an update scheduled for 14:00 UTC. The team also reserved the right to release patches earlier if details leak or active exploitation appears.
Security researchers at watchTowr have confirmed the vulnerabilities allow attackers to run arbitrary code. PHP has assigned both flaws a CVSS v4.0 severity score of 9.2. Some early reports cited a score of 10.0, but that rating does not appear in the official announcement.
Security firm Sansec warned that mass exploitation could follow quickly, saying that it expects "mass attacks to start within 15 minutes of the release." That projection underpins urgency among hosting providers and site operators to prepare for a rapid response once patches arrive.
Not all PHP branches are expected to receive regular upstream patches. The PHP team listed currently supported branches as 8.2, 8.3, 8.4 and 8.5. Branches such as PHP 8.1 and older are no longer officially supported and are not expected to receive fixes through the normal security release process.
Mallory reported that roughly 884,000 internet-facing hosts in its dataset are running PHP 8.1 or older, representing about 59 percent of the 1.5 million hosts that reported a PHP version. Mallory also published candidate fixed version numbers for supported branches, naming 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but it noted those numbers were not yet confirmed by PHP.
How Website Owners Should Prepare And Respond
Site operators should first determine who manages PHP on their systems. Managed hosting providers may apply the update for customers. Operators of VPS or dedicated servers need to plan to install fixes themselves or direct a system administrator to act.
Back up files and databases before applying any change. Check hosting control panels such as cPanel or Plesk for a patched runtime. If the server uses a Linux distribution, use the distribution package manager and watch for vendor backports that may not change the visible PHP version number.
After updating, restart relevant services, such as PHP-FPM, to ensure the patched runtime is active. Verify the version serving the website, since running php -v in a shell can show a different PHP installation than the web server uses. Confirm the website runtime has received the fix.
For systems running end-of-life PHP branches, contact the hosting provider about upgrading or obtaining a backported fix. If immediate remediation is impossible, consider taking affected applications offline or isolating them from public networks, a step recommended by CERT-EU to reduce exposure.
