Critical PHP Flaws Exposed Web Servers to Remote Takeover
Emergency security updates address two critical flaws in PHP request processing that allow unauthenticated code execution.
- By Jesse Jacobs
- Oct 21, 2026
Cybersecurity teams and server administrators are rushing to fix two serious vulnerabilities in PHP, the scripting language underpinning roughly 69% of all web servers.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, carry a CVSS severity score of 9.2. They allow unauthenticated attackers to execute arbitrary code remotely by exploiting memory corruption during basic request processing. Because the flaws trigger before application code runs, traditional web application firewalls and content management systems offer no native protection.
NBC News reported nearly 55 million web properties run PHP, according to internet scanning firm Censys. OpenAI, which assisted in discovering the bug through its AI-assisted security program, noted to NBC News that while AI models can accelerate vulnerability discovery, those same capabilities allow adversaries to rapidly develop exploits.
Remediation efforts grew chaotic when software developer Chainguard shared patch details six hours ahead of schedule, violating an embargo agreement with the PHP Foundation, the media outlet further reported. The early release accelerated scanning attempts by attackers and triggered voluntary site closures across the globe. Platforms including 4chan and Something Awful, along with daycare systems and video game portals in Japan, temporarily took their servers offline to wait for official patches.
Security teams have released emergency patches across PHP versions 8.2 through 8.5, alongside source backports for unsupported legacy branches. Major advisory bodies, including CERT-EU, the U.S. National Security Agency and the UK National Cyber Security Centre, recommend applying official updates immediately or isolating public-facing systems until fixes are verified.