Two PHP remote code execution flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4.0, have forced governments to take websites offline rather than leave them running. Australia's cyber.gov.au went dark alongside government sites across Europe, and hundreds of sites in total have been pulled. CISA issued an alert on 21 October telling organisations to patch immediately. The bugs are reported to be roughly fourteen years old.
The situation has deteriorated since the patch. Mirai botnet operators have joined the attacks, ASLR bypass exploits have appeared, and exploit attempts are now counted in the millions. That is a sharp reversal from the position on 20 and 21 October, when Huntress reported no exploitation in partner environments, no proof of concept and no public exploit code, and the flaws were absent from CISA's Known Exploited Vulnerabilities catalogue.
PHP shipped an out-of-cycle release at 14:00 UTC on 21 October, covering only the supported branches 8.2 through 8.5. Branches 8.1 and older receive nothing, and no workaround has been published. Mallory counted about 884,000 internet-facing hosts whose banners report PHP 8.1 or older - a banner count rather than a confirmed-vulnerable count, but it is the population with no fix available at any price. PHP 8.2 itself reaches end of life on 30 November, which moves another cohort into the same bracket in five weeks.
There is a disclosure story underneath the technical one. The CVE identifiers and a claimed CVSS of 10.0 came from a leaked post before PHP's own notice, which never named them. PHP has still not described how the flaws work. That is the inverse of Fortinet's decision the same week to ship patches on 22 October and withhold CVE identifiers until 10 November. Two opposite failures of coordinated disclosure in one week, both ending with attackers better informed than defenders.
Sources
CISA · The Hacker News · SecurityWeek · The Record · CNBC