Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now

What happened

On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon. Security researchers at watchTowr subsequently confirmed the vulnerabilities and identified them as CVE-2026-109618 and CVE-2026-109619. Coordinated disclosure had originally been planned for 22 October.

Later, on 20 October, the PHP security team published an advance notice warning of the vulnerabilities, without disclosing technical details or affected versions.

On 21 October at 13:37 UTC, PHP released security updates for both vulnerabilities, each rated 9.2 under CVSS v4.0. Both can lead to unauthenticated remote code execution across multiple PHP deployment configurations. Fixes are available for all four supported PHP branches, from 8.2 through 8.5.

Public exploit code also appeared before the official release, demonstrating a potential path to remote code execution against vulnerable Apache mod_php deployments. Organizations should now prioritize patching and investigating potentially compromised systems.

Vulnerability details and current status

Why this matters

PHP runs a large share of the web, and much of it is not where security teams look first. It sits under content management systems and e-commerce platforms, inside container images, in hosting control panels, and in the web interfaces of appliances and network devices. Much of it is managed by a hosting provider, an operating system vendor or an appliance vendor rather than by the organization that depends on it.

Because the flaws are in PHP itself, they sit below the application. Patching WordPress, Magento or a custom application does nothing for this. The fix has to be applied to the PHP runtime, by whoever owns that runtime.

The timing puts defenders under immediate pressure. Public exploit code appeared before PHP released its fixes on 21 October, with the researcher reporting successful remote code execution and an ASLR bypass against a vulnerable Apache mod_php configuration. Attackers can now study and adapt that code without having to reverse-engineer the patch. Although successful exploitation in the wild has not been independently confirmed, the availability of working exploit code significantly increases the risk of widespread attacks against unpatched systems. Organizations should prioritize deploying the fixes immediately.

What organizations should do now

1. Find every PHP runtime you are responsible for. Do not stop at web servers. Include container images, CI build images, serverless functions, development and staging hosts, and third-party products that bundle PHP. Record the exact version and how it was installed: an operating system package, an upstream build, a container image, a hosting provider or an appliance vendor. That determines who will ship your fix and when.
2. Rank them by exposure. Prioritize Internet-facing PHP applications, especially those accepting file uploads, administration panels, or payment and customer data. Internal systems reachable from user networks come next.
3. Identify what will not get a fix. Anything on PHP 8.1 or older is outside upstream support. Some Linux distributions and commercial providers backport security fixes to older branches, so check vendor advisories before assuming a system is unpatched based on its version number alone. Where there is no patch, restrict access to the system, isolate the system or migrate it to a supported branch.
4. Line up the people who patch for you. Confirm when hosting providers, managed service providers and appliance vendors will deliver updates. Operating system packages may lag behind upstream releases. Verify that the installed package includes the security fix, even if its version number differs from the upstream release.
5. Prepare to deploy and verify the updates. Pre-approve emergency changes, prepare testing and build pipelines, and rebuild container images using updated PHP packages or base images. Verify the fixed runtime is actually deployed, and restart affected services or replace running containers to ensure they load the updated code.
6. Reduce exposure while patches are pending. Remove unnecessary PHP applications from the internet and restrict administrative interfaces through VPNs or allow lists. Apply WAF and intrusion prevention protections, including targeted rules for these vulnerabilities where your vendor provides them, but do not assume generic rules will prevent exploitation. Disabling session.upload_progress is not a confirmed workaround for both vulnerabilities and must not replace patching.
7. Patch, then hunt. Begin monitoring exposed systems now and continue after updating. Look for unusual HTTP requests, unexpected PHP worker processes spawning shells or download tools, modified application files, web shells, and suspicious outbound connections. These are general indicators of compromise, not detections specific to these vulnerabilities. Prioritize investigation of systems that remained exposed before receiving the fix.

How TrendAI™ can help

• Shield vulnerable systems now with virtual patching. TrendAI Vision One™ TippingPoint™ provides Digital Vaccine filters. TrendAI Vision One™ Endpoint Security, including Server and Workload Protection, and TrendAI™ Deep Security, provide additional intrusion prevention. These rules shield vulnerable systems while updates roll out but do not replace patching.
• Detect exploit attempts on the network. TrendAI Vision One™ Network Detection and Response (NDR) detects PHP remote code execution exploit traffic.
• Decide where to act first. TrendAI Vision One™ Cyber Risk Exposure Management (CREM) maintains an attack surface view of the organization's devices, accounts, applications, cloud assets, and internet-facing assets. It assigns each asset a criticality level, and security teams can raise the criticality of the systems they know matter most. This gives a prioritized list of exposed systems to patch and investigate first.
• Look for signs of compromise. TrendAI Vision One™ raises Observed Attack Techniques and alerts for shell execution, web shells and reverse shells launched from PHP. Teams can also use XDR Data Explorer in TrendAI Vision One™ Agentic SIEM and XDR to search endpoint process activity for the behaviors described in "Patch, then hunt" above, such as PHP worker processes launching shells or download tools.
• Hand it off. For teams without the capacity to run this themselves, TrendAI Vision One™ Services – Managed Detection and Response (MDR) provides 24/7 detection, investigation, and response by TrendAI™ analysts.

TrendAI™ customers with questions can contact their account representative. For others seeking guidance and help, please contact us at https://www.trendaisecurity.com/en-us/contact or email incident_response@trendmicro.com.