Emergency PHP Patches Released Following Leak and Active Exploitation

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10. By overloading PHP’s memory, attackers can corrupt server processes to execute unauthorized commands. WatchTowr CEO Benjamin Harris confirmed the flaws affect all PHP versions from 5 through 8, noting that his firm successfully reproduced the exploit before the official patch arrived.

While the release was initially scheduled for later in the week, the premature leak accelerated the timeline. Cloudflare CTO Dane Knecht reported that the company observed early attack traffic targeting the vulnerabilities shortly after the disclosure. The Wikimedia Foundation confirmed that the PHP flaws were responsible for a temporary outage of Wikipedia, as it worked to secure its infrastructure.

The UK’s National Cyber Security Centre (NCSC) is urging administrators to patch systems immediately. For those unable to update instantly, the NCSC advises taking vulnerable systems offline to prevent unauthorized access. Cloudflare has deployed emergency firewall rules to filter malicious requests, though site owners remain responsible for verifying that their hosting environments are running the latest, secure versions of the language.