On 21 October 2026 CISA issued an alert and CERT-EU published advisory 2026-018, covering two remote code execution flaws in PHP core: CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. An unauthenticated attacker can run code on a web-facing PHP runtime. Emergency releases exist for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 7.4, 8.0 and 8.1 there is no fix, and there will not be one. That second sentence is the whole story, and it is not a security story.

What happened

Both flaws sit in core, not in an extension and not in a framework. Per the php.net release notes and the two advisories, they reach every mainstream way of serving PHP over HTTP: mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. No configuration turns a web-facing runtime into a non-web-facing one, which is why CISA and CERT-EU wrote the same sentence: patch immediately. Exploit attempts have been reported.

Two days later, on 23 October, a third flaw was disclosed as CVE-2026-115560. It has no patch yet.…