Internet-facing PHP systems are under active attack through two critical memory-safety weaknesses. Successful exploitation can let an unauthenticated attacker execute code on an affected server. The flaws were added to the US government’s known-exploited list after researchers reported working remote code execution. Security updates are available, and public proof-of-concept material increases the urgency.
What Happened
Two critical PHP weaknesses, CVE-2026-109618 and CVE-2026-109619, have moved from public concern to reported exploitation. Both are use-after-free conditions affecting multiple PHP versions. Successful exploitation can allow an unauthenticated attacker to run arbitrary code on an affected system, placing internet-facing PHP servers and applications at heightened risk.
The PHP Security Team released updates for the two weaknesses. Public proof-of-concept material became available, and researchers reported successful remote code execution against an Apache mod_php installation. The US Cybersecurity and Infrastructure Security Agency then added both issues to its Known Exploited Vulnerabilities catalog. Canadian authorities also cited open-source reporting that the flaws were being exploited in the wild.
The affected surface is not limited to one framework or hosting pattern. PHP installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all identified as at risk. The greatest stated risk is associated with mod_php because a demonstrated exploit can trigger before application-level code runs.
A separate remote-code-execution issue, CVE-2026-115560, was disclosed after the initial updates and is not fixed by them. Exploitation requires an uncommon combination of PHP configuration and application behavior. Until an update is available, the recommended mitigation is to disable session upload progress. Organizations that already applied that mitigation and kept it in place do not need an additional action specifically for this third issue.
Why It Matters
PHP remains widely deployed and supports a substantial proportion of web applications. That reach means a weakness in the underlying runtime can affect many different websites, business services and hosting environments even when their application code is unrelated.
The risk is particularly immediate for systems exposed to the internet. An unauthenticated path to code execution can give an attacker control before normal application checks are reached. Public exploit material and inclusion in the known-exploited catalog reduce the value of waiting for more certainty.
Legacy versions add another problem. PHP 8.1 and older no longer receive updates directly from the PHP project, although some distributions and long-term-support vendors may provide backported fixes. Organizations without a complete inventory may not know which services rely on unsupported branches or which vendor is responsible for supplying a correction.
What to Watch
Organizations should watch for further exploitation reporting, new detection guidance and a security update for the separate CVE-2026-115560 issue. Exposure to that third weakness depends on the application changing its serialization handler at runtime, so affected teams should verify behavior rather than assume every PHP installation has the same risk.
The reliability of internet-exposure estimates also matters. Earlier public discussion included disputed exploitation evidence, but later reports and government action provided stronger confirmation. Defenders should continue to prioritize verified technical findings and authoritative updates over untested claims or low-quality exploit demonstrations.
What Defenders Should Do
Inventory: Identify every PHP runtime serving web requests, including instances embedded in hosting panels, containers and less visible application stacks. Record the version, deployment mode, exposure and responsible owner.
Patch: Move affected systems to the appropriate fixed and supported version immediately. For PHP 8.1 and older, confirm whether a distribution or long-term-support vendor supplies a backported fix, or plan an upgrade to a supported branch.
Mitigate: Keep session.upload_progress.enabled set to 0 where the separate unpatched issue could apply. Teams that already disabled the feature for the earlier weakness should preserve that setting.
Prioritize: Start with internet-facing mod_php deployments, then work through PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Do not interpret a lower stated risk for another deployment mode as an exemption from review.
Validate: Confirm the version and configuration actually running in production after changes. Monitor exposed systems for suspicious requests, unexpected processes and other signs that exploitation may have occurred before remediation.
The Larger Lesson
Widely shared runtimes concentrate risk across otherwise unrelated applications. Once reliable exploitation and public proof-of-concept material exist, patch speed depends less on knowing the vulnerability name and more on having an accurate inventory, clear ownership and a way to verify production changes. Unsupported software makes each of those tasks harder.