Two Critical PHP Flaws Leaked Before Their Patches, and Cloudflare Saw Attacks Before the Fix Shipped

The fixes for two of the worst PHP bugs in years were supposed to arrive quietly, under embargo. Instead the details leaked early, a video circulated showing an exploit tool called PHP2Shell taking over servers running WordPress, Drupal and Magento, and Cloudflare said it was already seeing early attacks before the patches were out.

PHP runs a huge share of the web, and these bugs sit in code that nearly every PHP request touches. They reach back to PHP 5 from 2004. Only PHP 8.2 and newer get official fixes.

The leak

On Tuesday, October 20, the PHP security team gave advance notice of emergency updates for two critical flaws, each rated 9.2 under CVSS v4.0, due Wednesday at 14:00 UTC. It warned it reserved the right to release earlier "should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

The notice followed a now deleted Hacker News post by a user called "petecooper" claiming two critical PHP remote code execution bugs rated CVSS 10, going back to PHP 5, and naming CVE-2026-109618 and CVE-2026-109619. That post said disclosure was set for October 22. watchTowr said the original embargo was Thursday at 11am Eastern.

watchTowr CEO Benjamin Harris told BleepingComputer the bugs "have been leaked" and that "we can confirm that these vulnerabilities are indeed real," affecting PHP 5, 6, 7 and 8. His team reproduced CVE-2026-109618 but had not seen exploitation in the wild.

The leak came with a video. An unconfirmed report showed PHP2Shell executing code on servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS, Ars Technica reported. Sansec told admins to "expect mass attacks to start within 15 minutes of the release." One researcher estimated about 1.3 million internet connected hosts were likely affected.

What the bugs do

The PHP Foundation's writeup describes two failures in memory and error handling.

CVE-2026-109618 is triggered when a request hits PHP's memory_limit at exactly the wrong moment. PHP can leave partially initialized internal data behind and later treat it as valid. On Apache with mod_php, an unauthenticated request can trigger it before any application code runs, and full code execution was demonstrated with default settings. It was also confirmed on PHP-FPM through application code paths.

CVE-2026-109619 is a use after free. A fatal error at the wrong point can leave internal state pointing to memory from a previous request, which the next request on the same worker then uses. The reporter showed code execution against a real world app on Apache with mod_php.

The foundation says both affect "all PHP installations serving web requests," including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. Wiz adds that attackers can also read process memory that may hold passwords, tokens, API keys and certificates from other users' requests.

Wiz said its researchers found the flaws partly with AI tools, while OpenAI and the security firm Calif say they found them independently and worked together, according to WIRED.

Patch day

On Wednesday, Cloudflare pushed an emergency firewall rule update to every customer, free plans included. CTO Dane Knecht said the company was already observing early attacks and that the rules were a temporary measure.

The source fixes landed in the php-src repository at 13:34 UTC, and PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped at 14:00. Linux distributions and long term support vendors got patches in advance. PHP 8.1 and older get no official release, though the team published minimal source backports for 7.4, 8.0 and 8.1. "There are no complete mitigations, updating is the only safe choice," the PHP team said.

CISA urged immediate patching and told organizations that cannot update, or that run 8.1 or older, to take PHP systems offline until they can. It had not observed exploitation when it published. The UK's NCSC gave similar advice.

Some governments did not wait. Before the patches, several Finnish government sites, including the National Land Survey, were unreachable, and French government websites and the Port of Rotterdam's site were also reported offline. The FBI's Brett Leatherman asked anyone who finds signs of compromise to isolate the machine, keep web server and PHP logs, and report it.

It was a rough week for web trust all around, with browsers also pulling the compromised eMudhra certificate authority. Security consultant Lukasz Olejnik summed up the PHP stakes plainly: "The impact is enormous," and the worst case is "wormable malware affecting big chunks of the internet."

Some offers on this page may be paid placements or contain affiliate links.