Updated: PHP Releases Fixes for Two Critical Vulnerabilities; Some Websites Temporarily Taken Offline
The PHP project released updates for CVE-2026-109618 and CVE-2026-109619. The flaws may allow unauthenticated remote code execution; during patch deployment, some operators restricted website availability.
PHP vulnerability fixes are available for two critical flaws, CVE-2026-109618 and CVE-2026-109619. The project released PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to PHP, both vulnerabilities may allow unauthenticated remote code execution on installations that handle web requests.
During update deployment, some government and other organizations in Europe and the United States temporarily took websites offline. The Associated Press confirmed partial unavailability of Finnish government websites. The Record reported that more than one hundred websites were taken offline on Wednesday in response to the warning and patching. However, the exact number and complete list of affected services have not been independently confirmed.
PHP vulnerability fixes: affected web modes
The risk affects PHP installations handling web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP identified mod_php as the riskiest configuration.
The project also confirmed a demonstrated exploit for mod_php. The attack can be launched with an unauthenticated request before application code is executed.
The release of fixes and publication of technical details increase the urgency of deploying updates. Administrators should promptly identify internet-accessible applications using PHP and verify the server’s operating mode.
Packages for Ubuntu and cPanel updates are available
Ubuntu has released fixed packages for supported system versions. cPanel has also made updates available for supported versions of its product and the EasyApache4 component.
For the PHP 8.1 branch and older releases, the availability of fixes or backports is not stated. Operators of systems that cannot move to fixed PHP versions should temporarily isolate internet-accessible PHP applications.
- Update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 according to the supported branch in use.
- For Ubuntu and hosting, verify the availability of distribution or provider packages.
- Check servers using mod_php in particular, as well as PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
- If immediate patching is not possible, temporarily restrict or isolate publicly accessible PHP services.
Extent of active exploitation not yet confirmed
There are reports of early attacks based on a social media statement by Cloudflare’s CTO. However, available sources do not provide independent public confirmation of widespread active exploitation.
OpenAI claims it found the flaws before attackers did. However, this claim cannot establish that no exploitation existed before disclosure. An important signal would be any confirmation of attacks by CISA, the FBI, NCSC or other trusted authorities, or the inclusion of one of the flaws in CISA’s Known Exploited Vulnerabilities catalog.
The new versions address a problem with a confirmed possibility of remote code execution and a demonstrated attack against mod_php. For web service administrators, the priority is to deploy available updates or temporarily reduce the exposure of affected systems.
Sources
- PHP – Confirms the release of fixed versions, affected web modes, the nature of both flaws and the demonstrated exploit for mod_php.
- Ubuntu Security Notices – Confirms fixed packages for supported Ubuntu releases and the possibility of remote code execution for both CVEs.
- cPanel – Confirms the availability of updates in cPanel and EasyApache4 and identifies the affected product branches.
- Associated Press – Corroborates the temporary shutdowns and reports partial unavailability of Finnish government websites.
- The Record – Reports that more than one hundred websites were taken offline in response to the vulnerabilities.
Verified and updated: 10/21/2026 22:48
