Overview
- Security teams identified two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution by abusing memory-management errors.
- Researchers privately reported the bugs in August and the public disclosure and patch release raced against a leak that surfaced before fixes were widely deployed on Wednesday, October 21, 2026.
- PHP maintainers published emergency updates for supported 8.2–8.5 releases and national cyber agencies including the NSA and CERTs told organizations to update immediately or disconnect internet-exposed hosts.
- Cloud and infrastructure firms reported a sudden spike in exploitation attempts from thousands to millions within hours after details became public, and many governments and large sites temporarily took services offline to apply patches.
- Experts say the episode shows AI can speed both discovery and exploitation, stresses the need for faster coordinated disclosure, stronger patch management, isolation controls, and wider use of AI-enabled defenses.