PHP Core RCE: Patch CVE-2026-109618 Before Exploitation Hits

Two critical remote code execution vulnerabilities in PHP’s core interpreter — CVE-2026-109618 and CVE-2026-109619 — are being patched today, October 21, at 14:00 UTC. Official fixed versions land across PHP 8.2, 8.3, 8.4, and 8.5. If you’re running PHP 8.1 or anything older, no patch is coming. Sansec is predicting mass exploitation within 15 minutes of the release — so this isn’t a “schedule it for Friday” situation.

Patch PHP Now — Fixed Versions and How to Update

The PHP Foundation released fixes today: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both CVEs are patched across all four active branches. The first step is confirming what you’re running:

php -v

If you’re on shared hosting, check your control panel’s PHP version selector — cPanel, Plesk — and switch to the patched version as soon as your host makes it available. For Docker deployments, rebuild your images from an updated official tag such as php:8.4.27-apache. Managed WordPress hosts like WP Engine and Kinsta may handle the update automatically, but verify rather than assume. PHP is infrastructure, not a dependency your application can update on its own.

40% of Exposed PHP Servers Have No Fix

Of roughly 2.23 million publicly exposed PHP hosts, approximately 884,000 run versions with no official patch. PHP 8.1 hit end-of-life in December 2024 and receives nothing. PHP 7.x — still running on 28.7% of PHP websites — gets nothing either. The advice to “just upgrade to PHP 8.2” is correct but ignores the operational reality for teams stuck on legacy codebases.

Sansec called out WooCommerce, Magento, and Shopware stores explicitly. These platforms run on PHP at the infrastructure level — no plugin update or composer install will fix this. If you’re in this bucket, the options are: pressure your hosting provider for an emergency backport, arrange an expedited PHP version upgrade, or accept that you’re unpatched until you can migrate. The exploit reportedly affects PHP 5.4.0 and every version since, making the attack surface here enormous.

Related: Go 1.27.3: Eight CA Keys Blocked — Rebuild Now — another emergency security update dropping today.

How the Leak Shortened the Patch Window

Coordinated disclosure was originally set for Thursday, October 22. On October 20, details surfaced on Hacker News — including screenshots of an exploit tool named PHP2Shell, credited to Calif.IO — before being removed. The PHP Foundation moved the release up by 24 hours. Any threat actor who obtained the tool before removal had a day’s head start on defenders.

watchTowr CEO Ben Harris confirmed both vulnerabilities are real and that his team reproduced CVE-2026-109618. “While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real,” Harris stated. Security researcher Florian Roth added a practical detection note: exploitation will “most likely show up as suspicious child processes spawned by PHP, such as shells or download utilities launched from web server processes.” That’s your hunting signal in your SIEM or web server logs today.

Key Takeaways

• Patches drop October 21 at 14:00 UTC — fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Run php -v and act accordingly.
• If you’re on PHP 8.1 or earlier, no official patch exists. Contact your hosting provider today about an upgrade or emergency backport.
• Sansec predicts mass exploitation within 15 minutes of release. Prioritize internet-facing PHP servers first.
• Watch for suspicious child processes spawned by PHP — shells or download utilities launched from your web server process are the primary exploitation signal.
• Your application, CMS, or framework cannot fix this. PHP version is infrastructure; whoever controls the server controls the fix.