PHP released fixes for two critical vulnerabilities that may enable remote code execution.
Why it matters: The flaws are in PHP's core runtime, so updating an application, content-management system or plugin alone will not fix them. Cloudflare reported attack traffic targeting customers, but did not say it was exploiting either vulnerability.
- PHP fixed CVE-2026-109618 and CVE-2026-109619 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
- Both vulnerabilities have a CVSS v4.0 score of 9.2, the critical severity rating, according to their PHP security advisories.
- Cloudflare reported attack traffic targeting customers and said it deployed default web application firewall protections at 03:02 UTC on October 21; it did not attribute that traffic to either CVE.
- PHP 8.1 and earlier are outside the project's official support window and may require vendor-specific fixes or migration.
The PHP project released security updates on October 21 for two critical flaws tracked as CVE-2026-109618 and CVE-2026-109619. The project had initially scheduled the disclosure and patch release for 14:00 UTC. The available materials do not establish that the release was prompted by Cloudflare's observations.
Each advisory lists a 9.2 score under the Common Vulnerability Scoring System, or CVSS, a framework for rating vulnerability severity. The flaws can be triggered by specially crafted HTTP traffic and may enable remote code execution, or RCE, in which an attacker runs code on a target system. The advisories describe possible consequences; Cloudflare's report of attack traffic does not establish exploitation of these CVEs.
CVE-2026-109618 involves mishandling an out-of-memory condition - a failure to manage memory when available capacity is exhausted. The resulting invalid request-memory state can later be used to execute attacker-controlled code, according to the PHP advisory. CVE-2026-109619 involves stale global state, meaning runtime information left over after fatal-error handling, and a use-after-free condition, in which software accesses memory after releasing it, according to the second advisory.
The fixes are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Organizations using managed hosting should confirm that the provider updated the PHP runtime serving production traffic.
Cloudflare said its web application firewall, or WAF, protections are defense in depth rather than a replacement for patching, and reported default protections at 03:02 UTC on October 21. Its report said the vulnerabilities affect web servers running PHP 5.4 or later. PHP's supported branches are 8.2 through 8.5.
By the numbers
- 9.2 - CVSS v4.0 score for each vulnerability
- 4 - patched PHP branches: 8.2, 8.3, 8.4 and 8.5
- 03:02 UTC - Cloudflare's reported deployment time for default WAF protections on October 21
Yes, but: Cloudflare reported attack traffic against customers, not confirmed exploitation of CVE-2026-109618 or CVE-2026-109619. WAF rules can reduce exposure but do not replace updating the PHP runtime.
What's next: Organizations should upgrade supported PHP deployments and confirm runtime updates with managed-hosting providers. Users on PHP 8.1 or earlier may need vendor-specific fixes or migration.