CISA added two PHP engine flaws to its exploited list on October 26, five days after PHP shipped fixes. An attacker with no login can send crafted HTTP requests and run code on the server. Your framework offers no cover: CERT/CC says proof-of-concept exploits against Apache mod_php have fired before any app code runs. CISA says the bugs affect any PHP install serving web requests, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
What broke
CVE-2026-109618 corrupts memory when PHP runs out of it while setting up a request. CVE-2026-109619 is a use-after-free: state from one request outlives its memory, and a later request on the same worker touches it. PHP rates both 9.2. Datadog says the trigger sits in the POST body. Our read: a URL filter will not catch it.
The fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also published source backports for 7.4, 8.0 and 8.1. watchTowr says 7.3 and older are affected too, with no fix. On October 23 PHP flagged a third flaw, CVE-2026-115560, with no fix yet. It needs an unusual setup, and PHP suggests session.upload_progress.enabled=0 until the next release. On Windows, take the -1 builds, which also fix a Brotli flaw.
What is confirmed
Attackers moved fast. Cloudflare reported millions of attempts by early October 22. Censys counted about 4.18 million hosts running PHP on October 23 and calls them potentially vulnerable. That figure measures exposure, and says nothing about breaches.
Confirmed shells are scarce. On October 24, Adel Karimi logged 35 shells on three honeypots, and warned that the single-worker setup favored the attacker. Rapid7’s advisory, last updated October 27, says each public exploit works against one mix of OS, PHP version and web server. It has not observed exploitation in the wild, though it notes reports of attempts.
The worst report so far involves firewalls. On October 26, Dream said attackers rooted 25 servers by chaining these bugs with a Linux kernel flaw. Most were firewalls from a large vendor it did not name. Our read: appliances ship one stack to every customer, so an exploit tuned once can repeat.
We would not relax. Talos expects volume and skill to grow as stronger groups build their own tools. Be wary of early victim claims too: Unit 42 retracted its report tying these CVEs to a European government breach.
What to do
- List every system running PHP. CISA warns that PHP often sits inside other software, where you may not spot it.
- Update, then restart every worker. PHP says only an update fully fixes this.
- If you run 8.1 or older, or cannot patch now, CISA says to take the system offline.
- Take management interfaces off the internet.
- Hunt on patched hosts too. CISA says to watch for PHP workers spawning shells or download tools. ReliaQuest adds a log pattern: a POST returning 500, a memory-exhaustion error, then a worker crash. Datadog’s exploit returned 200 with no crash, so do not wait for that pattern. Rapid7 warns that clean logs do not prove you are safe.
Update, Nov 3
Exploitation in production is now confirmed, which changes the Rapid7 picture above. Palo Alto Networks confirmed on October 28 that attackers are exploiting exposed PAN-OS management interfaces. Dream’s update names PAN-OS. Hunt.io said on October 30 these are the first confirmed production compromises. Unit 42 says it verified the attackers’ tooling and results.
For websites, Hunt.io still saw no proof of reliable mass compromise. Kaspersky said on November 3 that no wave of breaches has come. Yet Censys data it cites shows 29 million of 46 million scannable servers still carry the flaws. That is a wider count than the 4.18 million hosts above.
Singapore’s CSA names affected products from Palo Alto, Cisco, Citrix, F5 and Siemens, and says the list is not complete. Check your appliances.