Critical PHP vulnerabilities: POC released, attacks starting

Listen

Share

Copy link

Email

X

Bluesky

Mastodon

LinkedIn

Facebook

WhatsApp

Telegram

Reddit

Updates with PHP advisory, confirmation of CVEs.

A pair of critical vulnerabilities in the PHP scripting language are under early active attack Wednesday.

The CVSS 9.4 vulnerabilities have been allocated CVE-2026-109618 and CVE-2026-109619.

They allow unauthenticated remote code execution (pre-auth RCE) attacks. Vast swathes of the internet use PHP, which was one of the most widely used scripting languages to emerge around the dawn of the web in the 1990s.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are fixed versions.

Cloudflare CTO Dane Knecht posted on Wednesday: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”

Over two million internet-facing hosts may be exposed. CERT-EU warned: "CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available."

The UK's NCSC said it is "encouraging UK organisations to prepare for immediate updating of systems using PHP.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Phoenix Security’s Marcus Webb added: “A core RCE affecting multiple major branches turns a routine dependency into a direct attack surface across content management, e-commerce, and custom web services at the same time.

“The exposure problem is made worse by version age: a large population of internet-facing hosts runs end-of-life PHP 5 and PHP 7, and those branches are not expected to receive a fix.” (PHP sits under a large share of the internet.)

Various POC exploits are circulating. Most appear to be AI slop. Expect effective real POCs to land very shortly and commoditised attacks to start.

The PHP security team only typically releases official security updates for supported active branches (PHP 8.2+).

The ever-industrious Florian Roth of Nextron Systems said he had prepared an open-source tool dubbed process-watcher for “everyone who doesn’t know what to do right now” after news emerged of the PHP vulnerabilities last week.

He wrote: “process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage.

“And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability. From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes.

“It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.”

A quick start for process-watcher is here. The project is here.

Saeed Abbasi, Head of Threat Research Unit at patch management specialist Qualys urged security teams to “inventory PHP installations and identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed. PHP 8.1 and earlier are no longer supported by the upstream PHP project, making these systems a priority for upgrade planning.”

Editor’s note: We trust Florian, but as ever with all things software, use at your own risk.

Know more than us already or have a working POC? Get in touch ed@thestack.technology / Signal @Targett.11

Add The Stack on Google

Share

Copy link

Email

X

Bluesky

Mastodon

LinkedIn

Facebook

WhatsApp

Telegram

Reddit

Edward Targett

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.