Key points
- Two critical PHP flaws, rated CVSS 9.2, have leaked details prior to the official security update.
- Cloudflare has deployed temporary WAF rules to block known exploit patterns for all customers.
- The PHP security team has moved its release schedule forward to October 21.
Cloudflare has detected early exploitation attempts targeting two critical PHP vulnerabilities whose technical details surfaced before the planned security release. The company has implemented initial Web Application Firewall rules to mitigate these threats while administrators await the official patch.
What happened
Cloudflare reported observing early attempts to exploit two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. These flaws were rated critical by the PHP security team with a CVSS v4.0 score of 9.2. The technical details of the vulnerabilities became public before the PHP team’s originally scheduled disclosure and update.
View the original post on X
In response to the leak, the PHP security team moved its release date forward to 14:00 UTC on October 21. Cloudflare’s chief technology officer, Dane Knecht, stated that the company is seeing early attacks and is updating mitigations as new vectors appear. The company has deployed an initial set of Web Application Firewall rules to block known exploit patterns.
These firewall rules are available to all Cloudflare customers, including those on free plans. Knecht described the WAF protections as a stopgap measure that addresses known exploit vectors. He urged administrators to patch their systems as soon as the PHP Foundation releases the official update.
Why it matters
The PHP security team has not yet published full technical details, including affected components, precise attack paths, or confirmed vulnerable versions. Researchers describe the flaws as remote code execution vulnerabilities, which could allow attackers to run code on a vulnerable server. However, specific outcomes remain unconfirmed without further technical disclosure.
Cloudflare’s warning indicates that exploitation attempts are emerging, but the company has not shared evidence regarding the scale or success of these attacks. Observed attempts underscore an immediate need for defenses but do not independently prove that attackers have successfully compromised PHP servers. The distinction between attempted and successful exploitation is important for risk assessment.
What happens next
- Identify every internet-facing system that runs PHP, including content-management systems and bundled runtimes.
- Monitor PHP’s official security notices and operating-system update channels for the release.
- Verify affected versions and apply the right update promptly once the fix is available.
- Do not rely solely on WAF rules, as new exploit patterns may evade initial protections.
Patch priority
Teams should prioritise internet-facing systems with direct public access for immediate attention. Before applying any update, ensure you have verified backups of your production environment. Test the patch in a staging environment that mirrors your production configuration to catch compatibility issues. Roll out the fix in phases, starting with the most exposed assets. If a fix is not yet available, restrict access to administrative interfaces and review firewall logs for anomalous traffic patterns.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: PHP
- Inventory all servers and containers running PHP to determine exposure levels.
- Configure monitoring alerts for unusual outbound traffic or process creation on web servers.
- Review Web Application Firewall logs for blocked requests matching the leaked exploit patterns.
- Prepare a rollback plan in case the security update breaks application functionality.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are there confirmed successful compromises of these PHP vulnerabilities?
Cloudflare has detected early exploitation attempts but has not confirmed any successful compromises or shared evidence of their scale.
When is the PHP security update scheduled for release?
The PHP security team has scheduled the release for 14:00 UTC on October 21, 2026.
Do Cloudflare’s WAF rules protect all users from these exploits?
The rules are available to all customers, including free plans, but are described as a temporary stopgap that may not block all new exploit vectors.
