Two serious security flaws in PHP, the software behind many of the world's websites

Two flaws were found in PHP itself, the engine that runs WordPress, Drupal, Wikipedia's software and millions of other sites. Either lets anyone on the internet, with no password, run commands on the

Not your phone or laptop: the flaw is on web servers. It affects organisations that run websites on PHP, and their visitors only indirectly. If you run a website, the question is whether PHP on its se

A fix has been available since 21 October. Organisations that run websites on PHP are installing it.

Every government cyber agency says: install the fix now. If you cannot, the US agencies say take the website offline; the UK puts that after temporary mitigations, and several European agencies say cu

Attackers are trying to use the flaws, in large numbers: millions of attempts by one internet security company's count. As of 16:05 UTC on 24 October, no named organisation has said it was broken into

A fix has been available since 21 October. Organisations that run websites on PHP are installing it.

Every government cyber agency says: install the fix now. If you cannot, the US agencies say take the website offline; the UK puts that after temporary mitigations, and several European agencies say cu

Attackers are trying to use the flaws, in large numbers: millions of attempts by one internet security company's count. As of 16:05 UTC on 24 October, no named organisation has said it was broken into

Whether any website was actually broken into before it installed the fix.

Whether the fix is complete. A report on 21 October suggested it may not be; the PHP security team replied on the mailing list on 22 October, and this site will settle the question once that reply is

Who leaked the news on 20 October, and where.

2026-10-17 One exploit attempt against a MadPot honeypot from a commercial anonymisation network, four days before disclosure; 'it remains unclear how the actor

2026-10-17 One exploit attempt against a MadPot honeypot from an IP on a commercial anonymisation network, geolocated to Australia, four days before disclosure.

2026-10-20 to 21 'We observed attack traffic targeting our customers' after the leak, and attackers 'mutating the attack payload to try to bypass our protections'. No

Every government cyber agency says: install the fix now. If you cannot, the US agencies say take the website offline; the UK puts that after temporary mitigations, and several Euro

Attackers are trying to use the flaws, in large numbers: millions of attempts by one internet security company's count. As of 16:05 UTC on 24 October, no named organisation has sai

Apache mod_php Unauthenticated RCE demonstrated over HTTP with default input and memory limits, before any application code runs.

PHP-FPM For CVE-2026-109618 the GitHub advisory says no complete FPM exploit has been demonstrated; the PHP Foundation blog says RCE was confirmed on FPM thro

php-cgi Listed by php.net among installations serving web requests.

{'commit': '3584a98bda0f2c0d367255b046798b0d3a221a19', 'short': '3584a98bd', 'subject': 'Avoid state corruption via bailout', 'author': 'Arnaud Le Blanc', 'authored': '2026-10-18T15:26:39Z', 'committe

[{'layer': 'The language a site is written in (PHP code)', 'in_scope': False, 'text': "Not where the bug is. A site's own PHP code can be perfect; php2shell.com's phrase is that a 'Hello World' applic

[{'step': 'Before the fix', 'text': "When a request pushed PHP past memory_limit, the allocator called zend_mm_safe_error, which raised a fatal error inside a zend_try and then called zend_bailout(): a C longjmp back to

Apache mod_php Unauthenticated RCE demonstrated over HTTP with default input and memory limits, before any application code runs.

PHP-FPM For CVE-2026-109618 the GitHub advisory says no complete FPM exploit has been demonstrated; the PHP Foundation blog says RCE was confirmed o