Critical PHP Flaws Take Websites Offline
The PHP project released emergency fixes for two flaws that can let an attacker take over a web server without logging in. PHP runs about 70% of the world's websites. In Japan, banks, businesses and two government ministries pulled pages offline to patch, and attackers are already trying the flaws, though no successful attack has been confirmed.
The PHP project has released fixes for two critical flaws in PHP, the programming language that runs on web servers behind about 70% of the world's websites. Both flaws can let an attacker with no password run their own code on a server, and in one demonstrated case a single request was enough, before any of the site's own code ran.
In Japan, Prime Minister Sanae Takaichi urged anyone running a website to install the update at once or suspend the service until they could. Banks, businesses and government ministries took sites offline for maintenance, and some pages of the Health and Finance ministries were temporarily closed to the public.
Attackers are already trying. Amazon's threat intelligence team said it saw a first attempt four days before the fixes came out and called the flaws "broadly exploited in the wild." No successful attack has been confirmed: the PHP Foundation said that to its knowledge no attempt to take over a server has succeeded, and other security firms said the exploit code circulating so far does not work.
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The U.S. cybersecurity agency CISA told organizations to update immediately.
Banks, businesses and government ministries in Japan took websites offline after the PHP project released emergency fixes for two flaws in the programming language that runs about 70% of websites worldwide.
PHP is the software many web servers use to build a page each time a visitor asks for one. It sits underneath common publishing systems such as WordPress, and many commercial products embed it without showing it. A flaw in PHP itself can therefore reach sites whose owners never wrote a line of it.
Japan's response
Prime Minister Sanae Takaichi posted on X urging people to check whether the websites they maintain use PHP and to apply the update as soon as it was available, or to suspend web services temporarily until they could. Chief Cabinet Secretary Minoru Kihara said public access to some content on the websites of the Health, Labor and Welfare Ministry and the Finance Ministry was temporarily suspended. CERT-EU, the European Commission's cybersecurity body, also issued a warning, and Reuters reported that Japan's National Cybersecurity Office and the U.S. National Security Agency did as well.
What the flaws do
Both flaws sit in parts of PHP that nearly every web request touches: memory management and error handling. The first, CVE-2026-109618, can corrupt memory when a request hits PHP's memory limit at exactly the wrong moment. On Apache servers running the common mod_php setup, the PHP Foundation said, an unauthenticated request can trigger it before any application code runs, and full remote code execution was demonstrated with default settings. The second, CVE-2026-109619, can leave a later request using memory that belonged to an earlier one. Each is rated 9.2 out of 10 for severity.
CERT-EU said every PHP installation that serves web requests is at risk and advised organizations to patch immediately or, where that is not possible, to cut internet-facing systems off from public networks until a fix is in place.
Attacks so far
Amazon Threat Intelligence said a decoy server it runs to attract attackers recorded an exploit attempt on October 17, four days before the fixes were released, from an address on a commercial anonymization network. "It remains unclear how the actor acquired exploit information prior to disclosure," it said, adding that it is unclear whether any of the attempts it saw would have worked on real systems. It now describes the flaws as "broadly exploited in the wild."
Cloudflare's chief executive, Matthew Prince, said attempts across its network grew from thousands in the 10 hours before the announcement to "millions now." The security firm watchTowr said the exploits being sprayed "either don't work at all, test for timing-based differences, or crash the target." Elizabeth Barron, the PHP Foundation's executive director, told The Verge that "to our knowledge, there has been no successful attempt at remote code execution." Dataminr's threat research team said activity so far was limited to scanning and non-working exploits, "with no known compromises."
Many servers remain exposed. The scanning firm Censys counted about 1.57 million internet-facing hosts on unpatched PHP versions on October 21, according to SecurityWeek, and VulnCheck said at least 1 million hosts run PHP versions that no longer get updates.
The fix
The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Linux distributions received the patches in advance. PHP 8.1 and older no longer get official updates, though because of the severity the PHP security team published minimal source fixes for 7.4, 8.0 and 8.1. CISA urged organizations to update immediately.
A disrupted release
The PHP Foundation said the problem behind the first flaw was first spotted in 2024, but work on a fix stalled and restarted for months, which it called "a structural failure." Researchers at the security firms Calif and Wiz and at OpenAI later showed how it could be exploited. When the flaws' ID numbers began circulating online on October 20, the project moved the release up a day, to October 21. It said the distributor Chainguard broke the embargo more than six hours early by publishing patched software, and that a video Calif posted by mistake helped others build test attack code.