The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors

If you run any website or application built on PHP, expect potential server compromise if you are not on PHP 8.2 or newer and have not applied third-party patches.

The PHP Foundation has announced critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, impacting PHP installations dating back to version 5 (2004). However, patches are exclusively available for PHP 8.2 and newer supported versions. While some third-party vendors may offer fixes for legacy deployments, the foundation stresses that updating is the only complete mitigation. The vulnerabilities allow unauthenticated attackers to execute code on affected servers or access sensitive memory, potentially containing credentials and API keys. Security firms like Cloudflare reported observing early attacks even before the official release of patches, with Sansec anticipating mass exploitation within 15 minutes. The discovery of these flaws involved AI tools, with Wiz, OpenAI, and Calif credited. The FBI and various national cybersecurity agencies are urging immediate patching and monitoring, with some organizations taking websites offline as a precaution.

The PHP Foundation's decision to limit patches to PHP 8.2 and newer creates a significant risk for a vast number of legacy web deployments that continue to power critical internet infrastructure. This leaves millions of systems, including popular platforms like WordPress and Drupal, vulnerable to immediate exploitation, as evidenced by early attack observations. The reliance on third-party vendors for legacy fixes introduces an uneven and potentially insecure landscape for outdated deployments.

The involvement of AI in discovering these vulnerabilities, coupled with their ease of exploitation and the critical nature of file upload interfaces, suggests a future where AI-assisted attacks become more prevalent and rapid. This event underscores the need for organizations to proactively manage their software supply chain, not just for direct code but also for the foundational components like PHP, and highlights the growing importance of continuous security monitoring and rapid response capabilities.