PHP RCE Vulnerabilities 2026: What to Patch

PHP RCE vulnerabilities 2026 were patched before most site owners had read a single advisory. An unverified Hacker News post on October 20, 2026 forced PHP to move its release forward by a day. The technical risk was real; the public details were wrong from the first hour.

What were the 2026 PHP RCE vulnerabilities?

The October 2026 PHP RCE vulnerabilities are two remotely triggerable flaws in the PHP runtime: CVE-2026-109618, a bug in cleanup after a request hits the memory limit, and CVE-2026-109619, which lets state from one request survive into the next on the same worker. PHP rates both at 9.2 CVSS and shipped fixes on October 21, 2026.

PHP, the server-side scripting language, published the fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Foundation's advisory describes the first as remote code execution through out-of-memory corruption and the second as remote code execution through stale global state. Neither requires a login.

The exposure model is the PHP worker loop: a web server hands a request to a worker, the worker builds the page, returns it, cleans up and waits. Both bugs live in that loop. PHP says risk is highest under Apache with mod_php, where a request can trigger the flaw before any site code runs, and that the second bug was also confirmed on PHP-FPM, the FastCGI process manager used with Nginx and Apache.

Who found the bugs, and why did the fix take so long?

Security vendor Calif reported the full remote code execution on August 11, 2026, and OpenAI reported the same root cause the same day, according to the PHP Foundation's account of the disclosure. Wiz sent additional attack paths on August 24, 2026. Wiz and Calif both trace the affected code back to PHP 5.4.

The root cause is older than the report. Calif traces the first PHP memory limit bug of this kind to 2004. The PHP Foundation says a 2024 external audit led one of its developers to early signs of the problem, but nobody found a concrete attack path, so the fix stalled. The Foundation calls that delay a structural failure.

Both vendors credit AI tooling with much of the discovery work. OpenAI says Calif used GPT-5.6 Soul in its Patch the Planet program, and Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Soul. A Wiz researcher summarized the year on X by saying AI did most of the work. Those are the vendors' own descriptions of their tooling, not independent measurements.

The security team's workload is part of the context. The PHP Foundation says its team published 15 CVEs since July 1, 2026 and worked through more than 100 reports that were invalid, duplicates or impossible to reproduce. PHP also lists only the branches it still supports in its advisories, which is why 8.1 and older receive no upstream update.

How the leak unfolded before patch day

The release plan was October 22, 2026, and an unverified Hacker News post on October 20 moved it up by a day. The post carried a wrong date, a wrong severity score and no technical detail, and its author later wrote that his source lied when asked whether the disclosure was coordinated. Kevin Beaumont, a security researcher, flagged the leak on Mastodon that afternoon.

Disclosure control broke down in stages. The security firm watchTowr confirmed the bugs were real and said everyone had been told to wait until Thursday. PHP moved its release to October 21 at 2:00 p.m. UTC. According to the PHP Foundation, Calif accidentally published a proof-of-concept video around 8:00 p.m. UTC; it was deleted, but copies spread.

Third parties then undercut the embargo from both directions. Cloudflare turned on firewall rules for all plans, including free, at 3:02 a.m. UTC on October 21, roughly nine hours before technical details went public. The PHP Foundation says ChainGuard published patched builds more than six hours early, which let anyone study the fix. The patches went live around 2:00 p.m. UTC.

Some operators pre-empted the risk. Uberspace, a German host, disabled PHP on all its servers before the release. A Dutch platform serving more than 100 local governments pulled its council sites offline, according to International Cyber Digest. PHP said it saw no working public exploit at release time.

Were the PHP RCE vulnerabilities 2026 exploited in the wild?

The attack evidence for the PHP RCE vulnerabilities 2026 is mixed and time-stamped: honeypot and sensor reports describe exploitation attempts, while vulnerability databases recorded no confirmed exploitation at the time of publication. None of the accounts below is proof of a successful site compromise.

The conflicting reports on October 21, 2026 looked like this:

• watchTowr: said its honeypots were seeing active exploitation attempts.
• Cloudflare: its CTO said early attacks were emerging and called the firewall rules a stopgap only.
• Patchstack: a WordPress security vendor, said at 1:57 p.m. UTC its data showed probing only, with no hard evidence of breaches.
• CISA: the CVE record showed exploitation as none, and neither bug was on the Known Exploited Vulnerabilities catalog.
• PHP team: reported no working public exploit at release time.

That contrast is a reminder that probes, attempted requests and confirmed breaches are different things. PHP history shows why the caution was warranted: CVE-2024-4577, a PHP CGI bug on Windows, and CVE-2019-11043, a PHP-FPM bug, are both in CISA's Known Exploited Vulnerabilities catalog, and CISA marks both as used in ransomware campaigns.

What did hosts and vendors say about the patch?

Hostinger said on X at 4:25 p.m. UTC on October 21, 2026 that it had tested the bugs on live servers, that they could not be used to take over sites it hosts including WordPress, and that it was applying PHP's fix across all hosting with nothing required from customers. That is Hostinger's own claim, and its status page and blog carried no notice of it when the video's author checked later that evening.

Other hosts published shorter statements. SiteGround and DreamHost said protections were in place across their servers, and Namecheap said it was installing the patches. cPanel shipped a fix covering PHP 8.2 through 8.5 and backported it to its 7.4, 8.0 and 8.1 packages, according to the video's reading of the cPanel EasyApache 4 change log.

One number that circulated widely needs care. A figure of 142,401 Hostinger hosts came from a Mallory analysis of Shodan data collected on October 20, 2026. The chart counts every PHP host on each network and its defined branches, not the number of unpatched Hostinger servers, so it does not measure exposure to these bugs.

On shared hosting you cannot patch PHP yourself. PHP core developer Gina Peter Banyard wrote on Mastodon that the hosting company should be the one dealing with it, and WordPress.org said no WordPress update is needed and site owners should confirm their host's plan. A regular VPS is the opposite case: Hostinger's own documentation puts security updates on the customer.

How to check whether you are patched

Check the PHP version your server actually executes, not the version your site was built against, and confirm it matches a fixed release or a distro build that backports the fix. Updating WordPress, Laravel or plugins does not address either bug because both live in PHP itself.

On shared hosting, open your host's control panel and read the PHP version there. On Hostinger it sits in the website dashboard under PHP Info, and Hostinger's help pages say the panel offers only 8.2 through 8.5; the help page tells anyone on 8.1 or older to upgrade. PHP says those older branches receive no update from the project, though small source backports for 7.4, 8.0 and 8.1 exist for people who compile PHP themselves.

On WordPress, go to Tools, Site Health, Info, Server to read the PHP version WordPress runs on. On your own server, install the fixed PHP from your Linux distribution or vendor and read the distro security notice. Red Hat and Ubuntu both note that distribution packages often backport the fix while keeping an old-looking version number, so the number alone can mislead.

A Cloudflare or host firewall rule buys time; Cloudflare's CEO called it a strong band-aid, and PHP lists configuration changes that do not make an installation safe. When patching is impossible, the UK National Cyber Security Centre and the FBI both advise considering taking the system offline until it is fixed.

Frequently asked questions

• Which PHP versions fix CVE-2026-109618 and CVE-2026-109619? PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Distributions may ship patched builds under an older version number, so confirm through your distro's security notice as well.

• Does updating WordPress fix these vulnerabilities? No. Both flaws are in the PHP runtime, so WordPress, Laravel and plugin updates leave the exposure untouched. WordPress.org says no core update is needed for this issue.

• Do I need to patch PHP on shared hosting? Usually not yourself, because the host controls the PHP build. You should still read your PHP version in the host panel and ask the host to confirm the patched version is live.

• Was there confirmed exploitation in the wild? The public record was mixed on October 21, 2026. watchTowr and Cloudflare described attack attempts, while Patchstack reported probing only and CISA listed exploitation as none and kept both CVEs off its known exploited list.

• Why did the patches ship a day early? An unverified Hacker News post on October 20, 2026 disclosed the bugs before coordinated release. PHP moved its publication from October 22 to October 21 and later saw third parties publish details and builds ahead of schedule.

Source video