Public agencies and companies in several countries have taken online services offline as they patch two critical PHP flaws that could let attackers run code on exposed web servers without authentication.
PHP released fixes Oct. 21 for vulnerabilities CVE-2026-109618 and CVE-2026-109619. Each received a CVSS v4.0 score of 9.2 out of 10. The updates cover PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project no longer updates version 8.1 or earlier, though some distributors and long-term support providers may offer backported fixes.
The flaws affect PHP’s runtime, so changing website application code or plugins alone does not address them, the PHP Foundation and Cloudflare said. Reuters reported that Cloudflare CEO Matthew Prince said on X that his network logged thousands of attempts in the 10 hours before public disclosure. He said the count later reached tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time of his post.
Amazon Threat Intelligence said it detected an attempted exploit against a honeypot on Oct. 17, four days before disclosure. Amazon did not know how the actor obtained information about the vulnerability and could not establish whether the attempts it observed would have succeeded on real systems.
The government of Australia’s New South Wales state said some websites were temporarily taken down for patching. As of its Oct. 22 statement, no state agencies had reported information breaches. Brazil’s federal management ministry said it took the SEI system offline as a precaution; government websites and GOV.BR remained available, and agencies used GOV.BR and email for urgent documents. The interruptions add to earlier precautionary shutdowns across European public services.
The Korea Herald reported that Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway suspended some internet services. It also reported that Japan’s Finance Ministry and National Tax Agency took some online services offline.
The PHP Foundation said the project moved its planned release forward after the vulnerability identifiers began circulating online Oct. 20. A developer had seen signs of an out-of-memory issue in 2024, but the Foundation said there was no concrete exploit path then. It cited limited staffing, a consensus-based process and technical trade-offs involving compatibility and performance as factors that delayed the work.
Singapore’s Cyber Security Agency said Oct. 23 that it remained aware of widespread exploitation attempts. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said its Oct. 21 alert had not observed exploitation as of publication. CISA advised organizations unable to update immediately to take PHP-based systems offline until patched.
PHP issued another advisory Oct. 23 for CVE-2026-115560, an unlikely remote-code-execution vector that requires a specific combination of settings and application behavior. The project recommended disabling session upload progress until its next regular bug-fix release, for which it gave no date.
