PHP emergency patch arrives a day early after flaws leak

The PHP emergency patch went live Wednesday at 10 a.m. Eastern, a full day ahead of schedule, after details of two critical security flaws leaked online a day earlier. The emergency release fixes remote code execution holes in PHP, the server-side language that runs a huge share of the web, from personal blogs to major publishing platforms. The flaws sit inside the language itself, which is why every site on an unpatched version is exposed even when its own code is perfectly secure. Security researchers say the flaws reach back through more than a decade of PHP releases, which means the pool of unpatched servers is enormous.

Why the update came a day early

The rush started with a forum post. Details of both vulnerabilities surfaced on Hacker News on October 20, while the coordinated disclosure was still under embargo and the official release was still planned for the following day. That leak is what pushed the PHP emergency patch out a day ahead of schedule. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Within hours of the leak, a working exploit began circulating online, and a demo video showed it running against servers hosting WordPress, MediaWiki, phpBB, Magento, Joomla, and several other common platforms. Cloudflare said it observed attack traffic aimed at its customers and switched on firewall protections at 3:02 a.m. UTC, well before the public announcement. The company still urged customers to patch, saying firewall rules are only an extra layer of defense.

What the flaws can do

Both flaws give an attacker a way to run their own commands on a web server without an account or a login. The PHP emergency patch closes holes that affect every installation serving web requests, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP, and LiteSpeed setups. The risk is highest on servers using mod_php, where the attack lands before the site's own code even starts running. PHP's own security team rates each flaw at a nine-point-two severity score, a critical rating. The underlying problem is broken memory handling: one flaw is triggered when an out-of-memory error interrupts PHP before request data is fully initialized, and the other lets internal state from one request survive into the next request handled by the same worker. Because the attack needs no login, automated scanners can probe for the hole at scale, and security firms have already reported exploit attempts in the wild. According to the project's security advisory, no application-level fix can close these holes, so updating PHP on the server is the only complete protection.

How the bugs were found

The discovery behind the PHP emergency patch started this summer, when Calif researcher Ryan Austin found the bugs while working with OpenAI's Patch the Planet initiative. Hackread reports that Austin used GPT-5.6 Sol through the initiative to surface the flaws in July. USA Today reports that Calif handed the findings to PHP Foundation security engineer Volker Dusch on August 1. Google-owned security firm Wiz independently found the same bugs with its own AI-assisted tooling, and researchers at Quarkslab also contributed to the disclosure. The bugs had been hiding in plain sight: a PHP core developer had already spotted the out-of-memory error behind one of the flaws during a 2024 code audit, but the team never reached agreement on a fix, and with no working exploit in hand at the time, the work stalled.

What to do now

The PHP emergency patch covers four supported branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP team also released source backports for 8.1, 8.0, and 7.4, while administrators on older releases are expected to upgrade to a supported branch. Securelist reports that the flaws cannot be patched through application code, so a plugin update or firewall rule alone will not close the hole. The project's security advisory strongly encourages every PHP user to update immediately. For most people, the fix is simple: log in to the web hosting control panel or contact the hosting provider and confirm the server is running one of the patched releases.

Sources: Securelist on the critical PHP flaws; Hackread on the emergency PHP fixes.