PHP Releases Emergency Fixes on Oct. 21 for 2 Critical Vulnerabilities

PHP developers disclosed two critical vulnerabilities, each rated 9.2 under CVSS 4.0.¹ CERT-EU identified the related issues as CVE-2026-109618 and CVE-2026-109619, warning that they could allow remote arbitrary code execution if exploited.³ The vulnerabilities could affect environments running PHP 5 and later, and depending on server configuration, could lead to code execution without authentication.²³ Data theft and website defacement were also cited as possible impacts, though the actual risk depends on the configuration of each server.²

PHP initially planned to release the fixes at 11 p.m. Japan time on Oct. 21.¹ The release time was moved up after information about the vulnerabilities began circulating online.¹ Reports said the planned release was changed from 10 p.m. to between 10:30 and 10:40 p.m.¹ Other reports said the decision was to release the fixes a day earlier than planned; the two accounts describe the move-up following the leak and the schedule change, respectively.¹²

The events leading to the fixes date back to an external security audit in 2024.¹ That audit found an issue that pointed to one of the vulnerabilities now disclosed.¹ The PHP team said it had been difficult to fix the affected memory-management and error-handling code, describing the delay in addressing it as a structural failure.¹ In 2026, security work also made use of tools such as Claude Mythos and Daybreak Red, developed by OpenAI.¹

Researchers at Calif reported a remote code execution issue, and OpenAI reported the same root cause on Aug. 11.¹ According to the PHP Foundation, the issues centered on memory-management and error-handling code.¹ Because that code is used in nearly every request, the issue was not limited to a particular feature.¹ However, the breadth of environments potentially affected by the vulnerabilities is not the same as whether they can actually be exploited on each server; the latter depends on configuration.²³

PHP is widely used on websites, and WordPress also relies on PHP.³ According to W3Techs, PHP is used by about seven in ten websites whose server-side programming language is known.² That share is calculated among sites for which the language could be identified, and is not presented as a proportion of all websites.² The widespread use helps explain why the response extended beyond individual technology companies to government, finance, transportation and consumer services.³

In Japan, Sakura Internet, Cygames and pixiv carried out emergency maintenance.³ Affected services also included BASE, niconico and DMM.com; games named included Granblue Fantasy and Umamusume: Pretty Derby.² In finance and transportation, Nomura, MUFG, ANA and East Japan Railway temporarily suspended some internet services.⁶ The Ministry of Finance also temporarily suspended some website services, as a wide range of operators restricted access in different ways.²³⁶

Japan’s Information-technology Promotion Agency and National Cybersecurity Office issued warnings, and Prime Minister Sanae Takaichi urged operators to prepare promptly to apply the fixes.² Takaichi said that if applying a fix immediately is difficult, temporarily suspending a website may help reduce risk.¹ Takaichi’s official website was also taken offline while administrators addressed the issue, and was later restored.¹ She also noted that website and server administrators play an important role because some operators may not notice warnings issued at night.¹

Cloudflare reported observing thousands of exploitation attempts in the period before the vulnerabilities were disclosed.⁶ The number reached tens of thousands within 45 minutes of disclosure, then rose to hundreds of thousands soon afterward and eventually reached millions, the company said.⁶ The company also said it observed attacks targeting the vulnerabilities on the day they were disclosed.² The sharp increase after disclosure is consistent with the authorities’ calls to speed up preparations for fixes and restrict access.¹

The PHP development team released the fixes on Oct. 21, but each operator had to install them on its own systems.² PHP users were urged to update promptly once the fixes became available.³ Software containing the patches had circulated more than 6 hours before the official release time.² A demo video was also accidentally published, and copies continued to spread after it was deleted, making the management of information before release another factor that sped up the response.² Applying the fixes closed the vulnerabilities, while temporary suspensions reduced exposure before they were installed; the two measures were separate parts of the short-term risk response.³ In Finland, government agency Valtori installed security updates overnight and gradually restored public websites.⁶