On 21 October, the PHP developers released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution without authentication. According to Cloudflare\u2019s CEO, Matthew Prince, following the public disclosure of the information, the company recorded millions of attempts to exploit these vulnerabilities.<\/p>\n
Briefly about the main points<\/strong><\/p>\n The PHP Security Team reported CVE-2026-109618 and CVE-2026-109619 on 21 October. Both vulnerabilities have been assigned a score of 9.2 out of 10 under the CVSS v4.0 system and, under certain conditions, could allow an attacker to execute code on the server without prior authentication.<\/p>\n The technical causes of the defects vary. CVE-2026-109618 is related to an internal state corruption during the handling of a memory shortage, whilst CVE-2026-109619 is related to the retention of an outdated internal state after a request has completed. The risk to a specific resource depends on the PHP version, server configuration and whether patches have been installed.<\/p>\n According to W3Techs, PHP is used by 69.3% of websites for which the service was able to identify the server-side programming language. This figure does not represent a proportion of all websites on the internet and does not indicate the number of potentially vulnerable sites.<\/p>\n According to Matthew Prince<\/strong>, even before the official disclosure, Cloudflare had detected thousands of suspicious requests. Following the publication of the technical details, the number of attempts to exploit the vulnerabilities reached tens of thousands within the first 45 minutes, hundreds of thousands within two hours, and subsequently millions.<\/p>\n These figures relate to attempted exploits detected by Cloudflare\u2019s infrastructure, rather than the number of servers that were successfully compromised. At the time of publication, the reports reviewed did not contain any evidence of a confirmed large-scale data breach directly linked to these two CVEs.<\/p>\n Cloudflare stated that, approximately nine hours before the public disclosure, it had activated WAF protection for customers using its web application firewall. Such rules can reduce the risk, but are no substitute for updating PHP.<\/p>\n In Japan, certain online services operated by the Mitsubishi UFJ Financial Group, the brokerage firm Nomura, the airline ANA and the railway operator East Japan Railway were temporarily restricted. These were precautionary measures whilst the systems were being checked and updated, and did not indicate that these services had been compromised.<\/p>\n ENISA, the European Commission, CERT-EU, Europol EC3 and the CSIRT network have urged organisations to check their systems without delay and apply the patches. If an immediate update is not possible, they advise considering isolating publicly accessible applications.<\/p>\n\n
Two defects with a score of 9.2 points<\/h2>\n
How the attackers\u2019 activity has increased<\/h2>\n
Precautionary restrictions on services and the role of AI<\/h2>\n