Two critical flaws in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on any server running affected versions. The PHP project assigned each a CVSS base score of 9.2 out of 10, and both are already being tracked by national cybersecurity agencies on both sides of the Atlantic.
PHP powers a large share of the web. Content management systems, e-commerce platforms, and internal business tools all depend on it. That reach is what makes these two flaws dangerous: every version from PHP 5.4 through 8.5.11 is affected, and the project will not patch PHP 8.1 or earlier because those branches have reached end of life.
The first flaw, CVE-2026-109618, is a memory-handling bug. An attacker can trigger an out-of-memory condition that interrupts PHP while internal request data is only partially initialized. Request cleanup then treats that invalid data as valid, corrupting memory in a way that can be leveraged for code execution. The second flaw, CVE-2026-109619, is a use-after-free: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may reuse that stale state before normal initialization resets it.
Wiz Research found both flaws, with help from Gemini 4 Argon, according to a blog post by Google Cloud CISO Chris Betz. The coordinated disclosure happened on October 21, 2026. NCSC, the UK's National Cyber Security Centre, issued an alert the same day urging organisations to update immediately.
Who Is Affected
Organisations using any version of PHP are affected. The NCSC stresses that discovery should not be limited to outdated installations; every PHP deployment needs to be inventoried and assessed, including appliances and services that bundle PHP as a dependency.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older than PHP 8.2 is on an unsupported branch and will not receive a fix. For those systems, the only real options are upgrading to a supported release or taking the system offline.
The PHP Foundation has published temporary mitigations for organisations that cannot patch right away. NCSC advises that if neither patching nor mitigations can be applied quickly, the affected system should be taken offline until it can be fully secured.
What Attackers Can Do
The attack does not require authentication. A threat actor can crash and hijack the affected system and, in the worst case, steal, alter, or wipe its data. The NCSC also notes that attackers may chain these two CVEs with others to implant PHP webshells and run commands as root.
Wiz and Google have nicknamed the exploit chain PHP2Shell. Because the vulnerability lives in the runtime itself, it bypasses PHP-level security settings. Native use-after-free execution runs inside the worker process, so application-level guards do not stop it.
Google Cloud is not itself vulnerable, but customers running PHP on Google Cloud may be. The company has published guidance covering App Engine, Cloud Run, GKE, and Marketplace solutions, and is rolling out patched base images for serverless platforms automatically.
How to Patch and Detect
Patching means updating PHP and redeploying the application. On containerised or serverless platforms, that means rebuilding images with a patched runtime and restarting the actual web-serving SAPI. Upgrading packages on disk is not enough; php-fpm, Apache, FrankenPHP, or LiteSpeed workers keep the old binary resident in memory until explicitly restarted.
For systems that cannot be patched immediately, Google's guidance recommends several compensating controls. Limit worker memory with cgroups rather than ulimit, which can trigger the vulnerable out-of-memory path. Run PHP workers under an unprivileged account with read-only access to document roots. Block outbound internet access from PHP servers to stop attackers from downloading payloads.
Detection is also possible. Google's Mandiant team added 23 curated detections to the Mandiant Frontline Threats rule pack in Google Security Operations. High-signal indicators include PHPSESSID cookies longer than 256 bytes, bursts of 50 to 150 concurrent OPTIONS requests, and child processes such as sh or curl spawned by php-fpm or httpd. Cloud Armor managed rules can block the known exploit patterns as a frontline defence while patching proceeds.
Wiz customers get agentless and runtime vulnerability detection plus exploitation detection through Wiz Defend. Google Cloud customers can enable the External Exposure service with the EXTERNALLY_EXPOSED_RCE_VULNERABILITY scanning module to find exposed PHP workloads across Compute Engine, GKE, and Cloud Run.
The Broader Pattern
This is not an isolated incident. The same week, CISA added related PHP entries to its Known Exploited Vulnerabilities catalog, and NCSC-NL published an inventory of software products with a PHP dependency that may be affected. The PHP security team has warned that third-party RPM mirrors may lag behind coordinated disclosure, so administrators should verify patches against official distro repositories rather than trusting mirror availability.
The speed of exploitation is the real concern. Google's blog notes that threat actors may use large payloads to trigger out-of-memory conditions, and the detection guidance implies that working exploits already exist in the wild. Organisations that delay patching are not gambling on a theoretical risk; they are leaving a known, scored, publicly documented hole open on internet-facing servers.
NCSC's advice is unambiguous: identify PHP installations across the infrastructure, prioritise internet-facing systems, update to a patched version, and monitor for future updates. For organisations on PHP 8.1 or earlier, the clock is not just about this CVE; it is about every future one that will never be backported.
The full technical details are in the PHP security advisory and the Wiz Research write-up. For more of our coverage of software vulnerabilities, see our cybersecurity section. Google Cloud's guidance, including the Cloud Armor mitigation steps and the full detection table, is published on the Google Cloud blog.
Administrators running PHP 8.1 or earlier face a harder choice than a patch: they need to migrate to a supported release before the next critical flaw lands, because the project has made clear it will not backport fixes to end-of-life branches. The PHP Foundation's temporary mitigations buy time, but they are not a substitute for an upgrade. Whether most organisations actually make that move before the next critical CVE is the open question, and history suggests many will not.