PHP's security team posted a short heads-up on its announcement list Tuesday. A release was coming at 14:00 UTC the next day, fixing two vulnerabilities, both critical. That was it. No bug descriptions, no list of affected versions.
CERT-EU filled the quiet quickly. Its advisory, out Tuesday evening, took the 9.2 rating on the CVSS v4.0 scale to mean unauthenticated remote code execution, which is the bad kind: someone on the internet runs commands on your server and never has to log in. The agency wanted organisations to work out every PHP application they had, line up patches for all of them, and if that wasn't possible, think about shutting the sites down until it was.
Australia's Cyber Security Centre said something similar, only gentler. Find your PHP systems, get ready to patch, watch for strange behaviour.
Both agencies said all versions from PHP 5 onward could be hit. Worth knowing where that came from, though. Social media posts, not PHP.
PHP runs a startling amount of the web. Security firm Huntress put it simply: "PHP is everywhere." It sits under WordPress, Drupal, Joomla and Magento sites, shared hosting platforms, control panels, and software that never mentions it. GoDaddy's warning was blunt too. Stolen data, defaced sites, or a server taken over completely.
That reach is the whole story here. One bug in one popular plugin hits the sites that installed it. One bug in PHP hits whatever sits on top of it, which is why a single advisory from Brussels got passed around by hosting companies and security teams within hours.
And these flaws aren't in some plugin you can just deactivate. They're in the interpreter. If a site runs a vulnerable PHP and serves requests through PHP-FPM, mod_php, php-cgi, FrankenPHP or LiteSpeed, it's in scope.
Patchstack timestamped the release at 13:52 UTC, eight minutes ahead of the announced time. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The 8.5.12 build is bigger than its security role suggests, with 90 fixes across 29 components.
The paperwork came in a rush just before that. The two GitHub security advisories went up at 13:34 UTC, and the CVE records followed at 13:48.
For 7.4, 8.0 and 8.1, which no longer get regular updates, the team published minimal source backports. That's unusual.
Now the bugs. CVE-2026-109618 starts with PHP running out of memory mid-request. It gets interrupted while the request's internal data is only half built, and the cleanup code then trusts that data anyway. CVE-2026-109619 is a leftover problem. State that belongs to one request outlives its memory, and the next request on the same worker can pick it up before PHP resets things. Researchers are calling the pair "php2shell."
PHP's advisory includes some configuration settings that block certain attack paths. The team says outright that they don't make a server safe.
Sources differ. The Australian agency said it knew of no active exploitation when it published its guidance. CyberScoop reported that details leaked online before the release and that a large internet infrastructure company had already seen early attacks. Patchstack says attacks are ongoing.
Assume the worst. Patches get reverse-engineered quickly, and plenty of sites stay unpatched for weeks after a fix ships. Wiz says this one covers the root cause and variants too, which helps.
Check your PHP version. Hosting panels usually show it, and on a server php -v does the job. If you run your own server or containers, install a patched release, rebuild any images that bundle PHP, and restart PHP-FPM or Apache so running workers drop the old code.
Don't forget the forgotten stuff. Old staging servers, a client's brochure site, the internal tool somebody built years ago and nobody owns now. CERT-EU asked for a full inventory first for a reason, because the box you've lost track of is the one that stays vulnerable.
On shared or managed hosting, it's your provider's move. Ask them when it's happening. Updating WordPress won't touch this, since the problem sits a layer underneath.
Stuck on 7.4, 8.0 or 8.1? Use the backports or get onto a supported branch soon. And if you truly can't patch today, CERT-EU's advice is the uncomfortable one: take the site down until you can.
PHP's advisory on php.net lists the affected versions and the configuration notes.
