PHP Patches Two Critical, Remotely Exploitable Zero-Day Vulnerabilities
Summary
PHP released fixes for two critical zero-days that can let unauthenticated attackers execute code and take control of servers. Active exploitation attempts have been reported; organizations should update to supported versions or take vulnerable systems offline.
Key points
- CVE-2026-109618 and CVE-2026-109619 are critical flaws with CVSS v4.0 scores of 9.2; both can be remotely exploited without authentication.
- The vulnerabilities can enable arbitrary code execution, server takeover and data theft; PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments are identified as at risk.
- PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier versions, including PHP 7 and 5, are unsupported and will not receive fixes.
- Working proof-of-concept attacks were confirmed for mod_php, and cybersecurity firms reported active attempts to exploit the flaws; successful compromises were not confirmed.
- The NSA, CERT-EU and the UK NCSC advised installing updates promptly or taking systems offline until they can be mitigated.
- The flaws were independently discovered by two research teams using AI tools and were reported to PHP maintainers in August; details leaked before the planned coordinated disclosure.
Article Details
- Vulnerability Types
- Memory corruption
- Stale global state
- Severity
- Critical; both vulnerabilities have a CVSS v4.0 score of 9.2.
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- If an immediate update is not feasible, take the system offline until it can be fully mitigated.
CVE
CVE-2026-109618vulnerability that can interrupt PHP and lead to invalid data being treated as valid, tracked as CVE-2026-109618, and a stale global state problem tracked as CVE-2026-109619. Both of the flaws have a "critical"CVE-2026-109619data being treated as valid, tracked as CVE-2026-109618, and a stale global state problem tracked as CVE-2026-109619. Both of the flaws have a "critical" CVSS v4.0 score of 9.2.
People
Chris WysopalVeracode chief security evangelist who commented on the complexity of the vulnerabilities and exploit chains.Ciaran MartinFormer founding head of Britain's National Cyber Security Centre; warned that the PHP2Shell vulnerability requires urgent attention.Don SmithSophos cyber-threat unit vice president of threat intelligence; advised monitoring PHP and web-server processes for signs of compromise.Ian Thornton-TrumpInversion6 CISO who described the vulnerability's attack surface as massive.
Vendors
Products
Apache"All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed" are at risk, the PHP team said. The risk is highest for mod_php, where two working proof-of-conceptFrankenPHP"All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed" are at risk, the PHP team said. The risk is highest for mod_php, where two working proof-of-conceptLiteSpeedPHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed" are at risk, the PHP team said. The risk is highest for mod_php, where two working proof-of-conceptPHPThe PHP Foundation released security updates to address two critical "PHP2Shell" vulnerabilities in its server-side code that have existed for more than a decade. Both of the vulnerabilities can be remotely exploited byPHP-FPM"All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed" are at risk, the PHP team said. The risk is highest for mod_php, where two working proof-of-concept
Tools
Gemini 4 Argonreported the flaws to PHP on Aug. 11 and 21. Another team, from Wiz, was independently using Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol and its own Wiz Atlas, and reported the PHP flaws to maintainers on Aug. 19 andOpenAI GPT 5.6 Solintelligence. They included members of offensive security firm Calif, who were using OpenAI's GPT-5.6 Sol, and working with the AI vendor as part of its Patch the Planet initiative, and who reported the flawsWiz Atlasteam, from Wiz, was independently using Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol and its own Wiz Atlas, and reported the PHP flaws to maintainers on Aug. 19 and 24.