Affected Systems

PHP (all versions prior to October 21, 2026 patches). Affects up to 80% of websites including WordPress, Drupal, Joomla. VirusTotal tracks 5.1 million exposed PHP hosts, ~3.8 million with open ports. Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 (critical RCE).

Exploitation Status

Active exploitation confirmed. Amazon Threat Intelligence observed first attempts on October 17, 2026 (4 days pre-patch) from anonymized VPN infrastructure. Multiple actors deploying exploits post-disclosure. Cloudflare, watchTowr, Previdian, Hadrian, and Patchstack detected unsuccessful attempts pre-disclosure. Dataminr reports activity limited to scanning and non-working exploits as of October 22, with no confirmed compromises yet. Working exploits expected imminently.

Business Impact

Critical remote code execution vulnerabilities in PHP enable full system compromise. With PHP powering 80% of websites, attack surface is massive. Early exploitation (pre-patch) indicates threat actor access to embargoed vulnerability details. Organizations running unpatched PHP servers face immediate RCE risk. UK NCSC directed organizations to patch immediately or take servers offline. Successful exploitation grants attackers complete control over web servers and hosted applications.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately apply PHP security patches released October 21, 2026 to all PHP installations (CVE-2026-109618, CVE-2026-109619)
  • Inventory all PHP servers using asset management tools; prioritize internet-facing systems running WordPress, Drupal, Joomla
  • Review web server logs from October 17 onward for suspicious PHP requests, connections from VPN/anonymization networks, and unexpected code execution attempts
  • If patching cannot be completed within 24 hours, take unpatched PHP servers offline or place behind WAF with virtual patching rules for CVE-2026-109618/109619
  • Monitor PHP security team advisories and threat intelligence feeds for working exploit code and adjust defensive posture as exploitation matures