Affected Systems
PHP versions 5.4 and later (all versions released in the last decade). Affects approximately 2.58 million Internet-facing hosts and 54.9 million web properties. Impacts sites running Drupal, Magento, Joomla, WordPress, and other PHP-based platforms. Fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. CVE-2026-109618 and CVE-2026-109619.
Exploitation Status
Active exploitation confirmed in the wild. Working exploits exist. Cloudflare detected exploitation attempts starting at 03:02 UTC on disclosure day. Government websites in Europe and elsewhere went offline following disclosure. Mass exploitation for web shell deployment expected.
Business Impact
Remote code execution and full server compromise possible. Attackers can install web shells for persistent remote control. Denial of service and data exposure also possible. Compared to Log4Shell in severity and scope. PHP is deeply embedded in web infrastructure across clouds, hosting providers, CDNs, and millions of independent servers. Patching will be prolonged due to widespread deployment and application dependencies. Immediate risk to public-facing web servers.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade PHP immediately to patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your branch
- Deploy WAF rules to block exploitation attempts; Cloudflare has published protective rules as of 03:02 UTC
- Scan web servers for indicators of compromise, specifically web shells in PHP application directories and unexpected PHP files in web roots
- Monitor PHP application logs and web server access logs for unusual POST requests or suspicious parameter patterns targeting PHP endpoints
- For Ubuntu systems, apply updated PHP packages released by Canonical; check vendor advisories for other Linux distributions and hosting platforms