Critical PHP flaws expose servers to remote takeover as websites race to patch
PHP maintainers released emergency fixes after details of two decade-old flaws leaked early. The vulnerabilities allow unauthenticated attackers to run code and take control of servers; some organizations have taken systems offline while patching.
By DoomRadar · Published on DoomRadar . Updated .
Places in the report
Countries named in the cited reporting. Highlighting does not show the area affected. Map: Natural Earth.
How the effects could reach youConditional effects
Event date: The PHP Foundation released fixes on Wednesday, after vulnerability details leaked on Tuesday; the source does not provide a calendar date or year. [1]
What happened
The PHP Foundation released updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both received a critical CVSS v4.0 score of 9.2, and the flaws had existed for more than a decade. [1]
References for this detail (1)
- Critical PHP Patches Address 'Very, Very Bad Vulnerability'govinfosecurity.com · Recorded source date: Oct 21, 2026, 6:32 PM UTC
The vulnerabilities can be exploited remotely by unauthenticated attackers, according to the security reporting, allowing them to execute arbitrary code, take full control of an underlying server and steal data. [1]
References for this detail (1)
- Critical PHP Patches Address 'Very, Very Bad Vulnerability'govinfosecurity.com · Recorded source date: Oct 21, 2026, 6:32 PM UTC
One flaw is a memory-corruption vulnerability that can cause invalid data to be treated as valid; the other involves stale global state. PHP maintainers urged users to update immediately after technical details leaked before a planned coordinated disclosure. [1]
References for this detail (1)
- Critical PHP Patches Address 'Very, Very Bad Vulnerability'govinfosecurity.com · Recorded source date: Oct 21, 2026, 6:32 PM UTC
The fixes cover PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Releases before PHP 8 are end-of-life and unsupported, leaving users on those versions without a security update from PHP. [1]
References for this detail (1)
- Critical PHP Patches Address 'Very, Very Bad Vulnerability'govinfosecurity.com · Recorded source date: Oct 21, 2026, 6:32 PM UTC
The response has already caused some service interruptions: Wikipedia took an unspecified number of systems offline for patching, and the Internet Archive briefly went offline. A New Zealand consultant said nearly nine in 10 New Zealand websites had not yet been patched. [3][2]
References for this detail (2)
- NZ websites slow to patch against critical PHP vulnerability discovered by AI – consultantnzherald.co.nz · Article published: Oct 22, 2026, 4:00 AM UTC
- PHP update: Why are so many websites down and when will they return?sbs.com.au · Article published: Oct 22, 2026, 4:02 AM UTC
Context from the sources
PHP is a server-side programming language used across a large share of the web. SBS reported an estimate that it powers about 70% of internet websites, making the exposure broad even though exploitation of particular sites is not established here. [3]
Explore the sources and reporting timeline
3 source links · 3 domains
These counts describe the references, not independent confirmations. Different outlets can repeat the same original report.
Source timeline
Oldest to newest among the available source dates, not a chronology of the incident. Article publication dates come from the source; other recorded dates may reflect when a link was found.
- [1] Critical PHP Patches Address 'Very, Very Bad Vulnerability'govinfosecurity.comReferenced for: detail 1, detail 2, detail 3, detail 4
- [2] NZ websites slow to patch against critical PHP vulnerability discovered by AI – consultantnzherald.co.nzReferenced for: detail 5
- [3] PHP update: Why are so many websites down and when will they return?sbs.com.auReferenced for: detail 5
Questions answered by the reporting
Which PHP versions received fixes?
PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 received patches. Versions before PHP 8 are unsupported and will not receive fixes. [1]
Have Australian government websites been breached?
Australia's industry and innovation minister said no breaches of Australian government websites had been detected, while the broader response included systems being taken offline for patching. [3]
What this could mean for you
Websites or online services may become unavailable during emergency patching.
Administrators may take vulnerable systems offline or restrict access while installing and testing fixes, as reported for Wikipedia and the Internet Archive.
Reported basis: [3] · The possible effect is interpretation.
Depends on: Operators identify vulnerable PHP installations and choose interruption as part of remediation.
Possible time frame: days, if those conditions hold.
A compromised website or server could expose stored data or allow unauthorized control.
The flaws reportedly permit unauthenticated remote code execution and full control of the underlying server.
Reported basis: [1] · The possible effect is interpretation.
Depends on: An attacker reaches an unpatched vulnerable PHP installation and successfully exploits it.
Possible consequences, not a forecast. Their relevance depends on your location and the conditions above.
For your country
Choose a country to check how this event could affect you.
What changes the outlook
Risk increases if…
Evidence of active exploitation against unpatched PHP installations would increase the immediate exposure.
More organizations taking websites or systems offline to patch would signal broader operational disruption.
Pressure eases if…
Organizations deploy the released fixes across supported PHP versions and verify that vulnerable systems are no longer exposed.
Operators on pre-8.0 PHP migrate away from unsupported releases or remove the vulnerable software.
Still unclear
The excerpts do not establish whether attackers successfully exploited either vulnerability or how many systems were compromised.
The duration and full geographic scope of the reported website outages are unclear.
Market implications
Market impact
Sources (3)
References for the reported details. Separate links do not necessarily mean independent confirmation.
Available excerpt
The PHP Foundation released security updates to address two critical "PHP2Shell" vulnerabilities in its server-side code that have existed for more than a decade. Both…A short excerpt from our source record; open the original for the full article.
Available excerpt
Nearly nine out of 10 New Zealand websites have yet to patch their systems against a critical security threat. Overnight, the creators of PHP, a…A short excerpt from our source record; open the original for the full article.
Available excerpt
A hugely popular programming language across the internet is connected to mass outages. AI systems have revealed a vulnerability in a programming language that runs…A short excerpt from our source record; open the original for the full article.
First tracked by DoomRadar: . AI-assisted analysis · . Based on linked headlines and available excerpts. Methodology · Report an error.