Updated 23 Oct 2026

On October 21, 2026 CISA released a recommendation to immediately patch recently disclosed critical vulnerabilities in PHP: 21 October CISA news release

Summary of vulnerabilties:

  • RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

  • CVE-2026-115560

    • On October 23, PHP disclosed CVE-2026-115560, a separate session-handling flaw that the October 21 releases do not fix.

Over the past 24 hours the number of verified attacks has grown to be in the millions…however as of this time (AM on 23 Oct) no verified successful breakins have been verified.  However a researcher has shown reliable code execution on a standard production environment.  PHP indicatred overnight that a third flaw has been identified for which a fix does not yet exist.

Be aware that there are still many vulnerable websites running PHP (note that well over 50% of websites use PHP, including those running WordPress)

  • Cloudflare saw tens of thousands of exploitation attempts within 45 minutes of the announcement. That rose to hundreds of thousands within 2 hours and millions by early October 22.
  • Censys detects over 3.08 million hosts and 56.6 million web properties running PHP. More than 34.4 million PHP services are still assessed as vulnerable as of October 23.

Impacts and Compromises?

  • Sophos says the lack of a successful attack suggests threat actors are struggling to build reliable exploits.
  • Previdian has seen no successful remote code execution and no dropped PHP files. Beelzebub, Dataminr and Wordfence report the same.
  • Cisco Talos says most activity so far is scanning, plus some uncoordinated attempts to deliver payloads.
  • VulnCheck developed a technique that bypasses a key memory protection (ASLR) and achieves remote code execution on x86-64 systems, even with PHP’s recommended production settings. That removes the main barrier the earlier exploits couldn’t get past.
  • SOCRadar found attacker tooling described as a “one-click” PHP2Shell exploit for PHP 8.4.26 under Apache mod_php.
  • In a separate campaign, attackers tried, unsuccessfully, to use the flaws to add servers to a Mirai botnet variant called Potassium.
  • Several government, school and hospital websites have gone offline as a precaution across Asia, Europe and North America.
  • The UK government confirmed 32 digital services are unavailable and four partially unavailable. The NCSC has issued about 50,000 warnings to organizations.

Actions recommended: focus on any systems including both public and private websites…especially any websites which handle sensitive information (PII, PHI, proprietary data, patient data, etc.)

  • Recommended next steps

    1. Finish patching and restart PHP. On any server not yet on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor backport), patch now. Restart PHP-FPM, Apache or IIS afterwards. Until a restart, the old code keeps running in memory.
    2. Disable session upload progress everywhere, even on patched servers. This covers the new CVE-2026-115560. For PHP-FPM pools, use php_admin_value[session.upload_progress.enabled] = 0. The feature only drives file-upload progress bars, so the impact is usually minor. Test any client apps that use upload progress bars.
    3. Hunt for compromise. Prioritize internet-facing servers that were unpatched any time after October 17, the date of the earliest exploit attempt seen.
      • Look for new or modified .php files in upload, cache and session directories.
      • Look for PHP worker processes spawning shells or curl/wget.
      • Look for outbound connections to the Mirai command server, 134.199.154[.]64, or its domain, thunder.godofthunder[.]st.
      • Attackers are trying to steal credentials and secrets from environment variables. On any server where you find suspicious activity, rotate its database passwords, API keys and app secrets.

Currently it appears that while Microsoft Azure systems are impacted, Sharepoint and OneDrive are likely not impacted as they run on .NET/IIS.  This is NOT official however.

Be aware that this is a developing situation…while application of the latest patches is critically important, be aware that while industry has been scrambling to deal with this, attackers are scrambling to exploit these and other vulnerabilities, so stay tuned.