Key information
On October 21, the PHP development team released urgent security updates to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both flaws carry a CVSS v4.0 severity score of 9.2, potentially allowing unauthenticated remote code execution on affected servers. The issues involve memory corruption and residual internal states after memory release.
The vulnerabilities triggered widespread precautionary measures, with government and private institutions across Europe, Japan, and the United States taking websites offline. In Japan, major gaming companies including SEGA, CAPCOM, Bandai Namco, and Cygames initiated emergency maintenance. Other affected platforms include Niconico, 4chan, and various community sites.
Security firm Sansec warned that large-scale attacks could occur within 15 minutes of the patch release. Cloudflare CTO Dane Knecht confirmed observing initial malicious activity, noting that while firewall adjustments provide temporary protection, they cannot replace the necessity of installing the official PHP updates.
PHP has released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to mitigate these risks. Experts emphasize that because PHP powers approximately 75% of websites with known server-side languages, including those using WordPress, the potential impact is vast. Administrators are urged to update immediately, though those on shared hosting may depend on their providers to apply the necessary environment patches.
