On 21 October, a large part of the internet went into maintenance mode at once. DeviantArt and Pokémon Home went offline. Wikimedia took many of the services behind Wikipedia offline. Government agencies in the Netherlands, Finland and Denmark pulled public sites, along with the Port of Rotterdam and several Dutch hospitals. Hosting providers ran emergency maintenance through the night and switched off PHP features on shared servers while they waited for packages.
The cause was two critical bugs in the PHP runtime itself: CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Both allow unauthenticated code execution, and both can leak worker memory — meaning passwords, session tokens and API keys belonging to other requests handled by the same process.
The embargo broke early
The CVE identifiers leaked two days before the planned release, so the PHP team shipped a day early. Cloudflare reported attack traffic before the fix was even out. CISA, the NSA, the UK NCSC and CERT-EU all issued the same instruction: patch now, and where that is not possible, take PHP systems offline or off the public internet until you can.
Why this one is so wide
PHP serves 69.3% of websites whose server-side language is known, according to W3Techs. On 21 October, Shodan returned 1,677,546 service records advertising an explicit PHP version.
Because the bug lives in the runtime, every application on an affected PHP is in scope: WordPress, Drupal, Magento, Laravel and bespoke code alike. CISA's alert said the quiet part out loud — PHP "is often a component of other software and prevalence may not be directly observable."
The blind spots are the familiar ones. Admin panels listen on ports a scan of 80 and 443 never touches: 2083, 2087, 8080, 8443, 8880. A host with a static site at `/` can still run phpMyAdmin at `/phpmyadmin/` or Roundcube at `/webmail/`. Setting `expose_php = Off`, or a CDN rule that strips `X-Powered-By`, hides the version from exactly the tools people use to find it. Firewalls and hosting panels — pfSense, OPNsense, FreePBX, cPanel, Plesk — ship their own PHP, so the real fix arrives as a vendor update. Container images built on an old `php:` base keep that PHP until someone rebuilds them. And staging copies, agency-built campaign sites and forgotten acquired domains live outside the inventory entirely.
The patch, and the step people skip
The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older are affected all the way back to 5.4 — those branches have to be moved or covered by a vendor package that backports both fixes; PHP published minimal source backports for 7.4, 8.0 and 8.1.
The step that gets missed: installing the fixed package does not change a worker that is already running. The old binary keeps serving requests until PHP-FPM, Apache and LiteSpeed are restarted. ProjectDiscovery's remediation guide makes the check blunt — after the upgrade, list any process still running a PHP build that was replaced on disk. The list should print nothing.
Priorities matter too. php.net rates Apache `mod_php` hosts highest risk, because a single unauthenticated request can trigger the attack before any application code runs. On the opposite side, an exposed port 9000 is a PHP-FPM default FastCGI listener; if it answers from the internet, close it.
Assume the worst on unpatched hosts
The memory-leak half of these bugs is the part that outlives the outage. If an affected server was reachable from the internet before you patched it, the working assumption should be that secrets held in its worker memory were exposed: rotate database passwords, API keys and session signing keys, and look for signs of compromise rather than waiting for one.
Alongside the guide, ProjectDiscovery launched SecureTheWeb.org, a notification service that matches advisories against Chaos — its internet-wide index of exposed services — and emails the `security@` inbox of every domain running an affected version. These two CVEs are its first event, and the notices are already going out. That is a reasonable model for the next one: the infrastructure that runs the internet is mostly old, mostly unmanaged, and rarely listed anywhere a security team can see.
