A critical PHP RCE is being exploited before today's patch ships

Exploit code for a critical PHP vulnerability leaked publicly on 20 October, a day before PHP’s own scheduled fix, and attackers started using it almost immediately. Cloudflare says it detected the first attacks at 07:43 UTC on 21 October and pushed emergency WAF rules to every customer, including the free tier, hours ahead of PHP’s planned 14:00 UTC release.

Security researchers at Sansec have linked the leak to two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, affecting every PHP install back to version 5.4. PHP’s own security team has not confirmed those CVE numbers or published technical detail; its advisory still says only that a release is coming, not what’s in it. Sansec’s advice in the meantime: block multipart/form-data requests at the web server, sit behind a WAF, or take exposed servers offline until you can patch.

Why it matters: this is PHP itself, not a plugin or a framework, so it reaches WordPress, Laravel, Drupal, Joomla, Magento and anything else running on a vulnerable version. If you can’t patch the moment PHP ships a fix, the stopgap is blocking the exposed surface at the server or proxy layer now, not waiting for your next deploy window.

The caveat: the CVE numbers and exploit details come from security researchers working off a leak, not from PHP’s own advisory, which as of writing names neither. Treat the specifics as provisional until php.net confirms them directly.