cyber.hendryadrian.com
Vulnerability & Exploit · darkowl.com

Critical PHP RCE Flaws Prompt Emergency Patches and Forum Shutdowns

· Original article ↗

Summary

PHP released emergency fixes for two critical RCE flaws, CVE-2026-109618 and CVE-2026-109619. Agencies urged operators to patch or take sites offline; three darknet forums reportedly shut down while awaiting updates.

Key points

  • PHP maintainers released emergency fixes on October 21, 2026, for CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2.
  • The article reports that PHP versions from 5 onward may be affected; a researcher estimated more than 1.3 million websites are vulnerable.
  • Government agencies in the U.K., Canada, Australia, and the EU urged operators to take sites offline if they could not patch promptly. Finland’s government and the Dutch House of Representatives reportedly disconnected their sites.
  • BreachForums, DarkForums, and PwnForums reportedly went offline while awaiting PHP patches, with administrators announcing the outages on Telegram.
  • The flaws were reportedly identified using AI models, and details surfaced online before PHP’s planned coordinated disclosure.
  • The article says no stolen data tied to these CVEs had been shown at the time of writing.
  • Recommended actions include updating PHP, checking overlooked deployments, reviewing logs and file systems for signs of compromise from October 20 onward, and monitoring for downstream data exposure.

Article Details

Vulnerability Types
  • Remote code execution
Severity
Critical; PHP rated both vulnerabilities CVSS 9.2
Affected Versions
  • PHP 5 onward (public reporting suggests affected)
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Take systems offline until PHP can be updated.

CVE

CVE-2026-109618On October 21, 2026, PHP’s maintainers released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which were identified through the use of AI.CVE-2026-109619On October 21, 2026, PHP’s maintainers released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which were identified through the use of AI.

Vendors

DarkOwlDarkOwl Vision indexes the forums, markets, chats and leak sites where stolen data appears, so security teams can detect exposure before it is misused.

Products

DarkOwl VisionDarkOwl Vision indexes the forums, markets, chats and leak sites where stolen data appears, so security teams can detect exposure before it is misused.PHPOn October 21, 2026, PHP’s maintainers released emergency fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which were identified through the use of AI.

Tools

OpenAI GPT 5.6 SolResearchers found the bugs using OpenAI’s GPT-5.6 Sol model, and Wiz independently found them with frontier AI models, per Cybersecurity Dive.

Countries

AustraliaGovernment agencies in the U.K., Canada, Australia and the EU (CERT-EU) urged operators to take sites offline until they could update PHP.CanadaGovernment agencies in the U.K., Canada, Australia and the EU (CERT-EU) urged operators to take sites offline until they could update PHP.FinlandThey also took down their own websites, government websites in Finland and Edinburg council and the BBC all took down webpages as well as countless others.

Related Articles