Cloudflare activated default web application firewall protections for affected customers after seeing traffic aimed at two critical PHP flaws before the PHP project released fixes on Oct. 21.
Cloudflare said the protections took effect at 11:02 p.m. ET on Oct. 20. That was 03:02 UTC on Oct. 21. Its report described traffic directed at the vulnerabilities, but did not establish that a customer had been breached. The firewall action gave affected customers an added safeguard while operators prepared updates; installing a patched PHP runtime remains necessary to fully resolve the risk. EconoTimes has previously covered the report on Cloudflare’s attack traffic.
The PHP project published fixes on Oct. 21 for CVE-2026-109618 and CVE-2026-109619. Version 4.0 of the Common Vulnerability Scoring System (CVSS) gives both flaws a 9.2 rating, in its critical tier. The project lists PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as corrected versions. EconoTimes previously listed the four fixed PHP releases.
An attacker could use either flaw to run code on a vulnerable server without signing in. The defects sit in PHP’s runtime, which processes a website’s requests, so changing site content or add-ons would not repair the affected component. In controlled test environments, researchers showed that the flaws could expose data kept in PHP memory, including passwords, tokens and API keys. They also reproduced code execution on servers configured for WordPress, Drupal and Joomla; the tests did not show that live sites had been compromised.
When the updates were released, PHP’s security team said it had not observed a working exploit in use outside testing.
Operators need to install a corrected version of PHP itself. PHP 8.1 and older no longer receive standard updates from the project, so administrators using those branches need to check for a vendor fix, an applicable source backport or an upgrade. A plug-in update alone cannot fix the vulnerable PHP runtime.
