PHP Flaws Let Attackers Own Web Servers Before the Warning Even Went Out

Key points

• Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, let attackers run unauthorised commands on web servers without logging in.
• PHP published patches for both vulnerabilities on 21 October, but details leaked on social media before the official release, giving criminals a head start.
• Amazon recorded exploitation attempts against its systems on 17 October, days before the public warning, and saw follow-up attacks from multiple actors on 21 October.
• Cybersecurity firm Wiz estimated roughly 70 percent of the internet runs PHP, putting an enormous number of sites in scope.
• The UK's National Cyber Security Centre (NCSC) says any system that can't be patched immediately should be taken offline.

PHP (short for PHP Hypertext Preprocessor) is the programming language that runs quietly behind the scenes on a huge portion of the world's websites, handling everything from login pages to shopping carts. The problem disclosed this week isn't in one website or one company's software. It's in PHP itself.

The NCSC published its advisory on Thursday, and the technical picture it describes is serious. We've covered PHP security issues since July, and what's unfolding here, as our 21 October story first reported, is a breakdown in coordinated disclosure as much as a technical failure.

What exactly is the flaw?

There are two separate bugs that together create a dangerous chain. The first, CVE-2026-109618, causes PHP to run out of memory mid-way through handling a web request, a situation known as an out-of-memory (OOM) condition. When that happens, PHP starts cleaning up, but parts of the incoming request data were never fully set up, so the cleanup code corrupts the server's memory in the process.

CVE-2026-109619 compounds the problem. Internal data tied to one web request can survive in memory after it should have been discarded, and the very next request handled by the same server process may pick up that leftover state before its own setup is complete.

Chained together, these conditions let an attacker execute their own code on the server without ever entering a username or password. The US National Security Agency warned that such flaws "often provide a direct path to the server's file system or database" and can allow criminals to steal data, disrupt services or move deeper into a network.

How did attacks start before the warning went public?

The vulnerabilities had apparently sat unnoticed for at least a decade, first identified by AI-assisted research. The PHP Foundation planned a coordinated release of both the discovery and a complete fix later in October, a standard practice that gives organisations time to prepare. That plan fell apart when details leaked on social media on Tuesday.

Amazon's chief security officer CJ Moses said the company had already recorded a "PHP2Shell exploitation attempt" on 17 October, before the embargo broke. The attacker used an anonymous internet address, a sign of deliberate concealment. After the leak, Amazon saw further attempts on 21 October; Moses noted that varying methods and anonymisation tools across those later attacks suggested several different criminal groups, not one. AI tools are accelerating this pattern, he said, allowing criminals to act "within hours or even minutes once technical details of a vulnerability are disclosed."

The Dutch cybersecurity agency took itself offline as a precaution. Finland shut down public government web services. Wikipedia removed parts of its site. All of this was consistent with official guidance across the UK, US, EU and Australia: patch immediately, or pull the system down.

PHP released patches on 21 October. The NCSC's position is unambiguous: apply them.

Should ordinary website visitors worry?

If a site you use runs unpatched PHP, an attacker who breaks in could access whatever that server holds, including account details or payment records. You wouldn't know from the outside.

If you run a website yourself, even a small one on a shared hosting plan, check with your hosting provider whether PHP has been updated. Most major providers will handle this automatically, but it's worth confirming. If you use a content management system like WordPress or Joomla, both built on PHP, the same advice applies.

The pace of the response, and the fact that exploitation began before the official warning, is what defenders should fixate on. The patch window isn't shrinking. For practical purposes, with AI-assisted attacks launching within hours of a leak, it's already gone.