PHP critical remote code execution
Report edition: 22 October 2026 · PDF page 5
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
- Operational priority
- Critical
- Evidence
- Patches; observed attack traffic
Patches released 21 October; exploitation attempts reported
Priority is conditional on actual exposure. An asterisk highlights especially conditional exposure; these are editorial judgments, not CVSS scores.
Explore this topic in depth
Ten detailed reports: four shared analyses and six audience perspectives. Research reviewed 22 October 2026; the original PDF account remains below as a dated snapshot.
Research update and qualifications
CERT-EU’s 21 October advisory describes two unauthenticated remote-code-execution vulnerabilities and identifies patched PHP branches. It says all web-serving installations need assessment, with Apache mod_php considered the highest-risk configuration. Application-level login controls do not remove a runtime vulnerability.
CERT-EU PHP advisory · Primary advisory revisited.
A vulnerable installation is not evidence that its customer records were accessed. Market share cannot establish an affected-user count.
The original PDF snapshot
What the report establishes
CVE-2026-109618 and CVE-2026-109619 permit unauthenticated remote code execution; CERT-EU rates each 9.2. PHP identifies Apache mod_php as the highest-risk configuration, while all web-serving installations need assessment. Cloudflare reports exploit traffic and changing payloads. Observed attempts do not establish a victim count.
Impact and potential reach
PHP-backed websites, commerce platforms and embedded services. Web-serving installations require assessment; affected users cannot be counted from PHP market share.
Required actions
Platform owners: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-confirmed backport. Verify running workers and rebuilt images. Cloudflare deployed WAF protections on 21 October; verify that relevant traffic passes through the protection and restrict direct origin access. WAF coverage does not replace the runtime patch.
Six perspectives on this topic
For the business manager
Keep sales, fulfilment and support working from the same service-status decision. Establish whether checkout is paused, orders are accepted but delayed, or only a supporting feature is unavailable. A technical patch window is an operating change when it affects promises already made to customers.
Read the business manager report for priorities, evidence and a decision checkpoint.
For the business owner
Decide how much interruption the business can tolerate and fund both the urgent fix and removal of unsupported dependencies. Separate a short-term containment decision from the longer-term case for managed commerce. The business case should include maintenance effort, integration changes and the cost of staying on an unmaintainable estate.
Read the business owner report for priorities, evidence and a decision checkpoint.
For the technical manager
Coordinate hosting, application and security teams around an asset-level remediation register. A host saying it has patched its platform does not establish which application pools or container revisions your business is actually running. Give every exception a named owner, compensating action and review time.
Read the technical manager report for priorities, evidence and a decision checkpoint.
For the software engineer
Trace a production request through the proxy, web server and PHP worker to establish the runtime that handles it. Keep investigation and remediation work distinct: a successful regression suite proves business behavior, while deployed-version evidence proves that the intended runtime change reached production. Neither alone clears a suspected compromise.
Read the software engineer report for priorities, evidence and a decision checkpoint.
For the customer service
Translate the confirmed operating state into a clear answer about orders, account access and expected updates. Avoid telling customers their data is safe just because the site is back online. Security findings and service restoration are different statements and need different approval.
Read the customer service report for priorities, evidence and a decision checkpoint.
For the customer
Use the business’s established website or support channel for updates. A maintenance notice alone does not show that your information was stolen. If a purchase appeared to fail, confirm its order and payment status before placing the same order again.
Read the customer report for priorities, evidence and a decision checkpoint.
In this section
- PHP: Evidence and scopeA vulnerable installation is not evidence that its customer records were accessed. Market share cannot establish an affected-user count.
- PHP: Business impact and costsA shutdown can stop orders while a rushed restoration can reintroduce an unsafe runtime. Assess both the interruption to selling and the investigation required if an exposed service could reach customer or payment-related records.
- PHP: Technical exposure and controlsMap public hostnames to the actual executing runtime, including containers, appliances, hosting control panels and background workers. Record the owner and patch authority for each deployment.
- PHP: Response and recoveryReopen only when the runtime remediation is verified, critical trading tests pass, and the incident owner has decided whether further investigation is required.
- PHP: Business manager reportWhich customer promise becomes impossible if this service stays restricted for another business day?
- PHP: Business owner reportWho can prove that every internet-facing PHP service has an accountable maintenance path?
- PHP: Technical manager reportWhat evidence would reveal a second, forgotten installation after the first one is fixed?
- PHP: Software engineer reportCould rollback restore the vulnerable runtime, and what safer recovery option exists?
- PHP: Customer service reportCan a customer tell whether to wait, retry later or contact support about an existing order?
- PHP: Customer reportIs there a confirmed action for my account, or is this a general service update?