Two new flaws in PHP, the language behind most of the web, are under active attack

Two memory flaws disclosed on 21 Oct 2026 in PHP, the programming language behind roughly 70% of websites, are now being exploited in the wild. The only reliable fix is a version upgrade: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 shipped on 22 Oct 2026, addressing CVE-2026-109618 and CVE-2026-109619.

Both flaws sit in PHP's own memory handling, not in any website's application code. One lets an attacker run their own code on the server (a "remote code execution") by tripping an out-of-memory handler that uses a long-jump instruction, leaving the request's memory partially initialized. The other reuses memory that should have been freed: state from one request survives in global variables and is picked up by the next. The PHP project says no configuration change fully blocks either bug; the only complete mitigation is upgrading (PHP changelog, PHP advisory).

The worst-case deployment is mod_php, where PHP loads directly inside the web server. There, an unauthenticated request can trigger the bug before any application code runs. WAF and hosting-layer filters can blunt the attack, but the project does not promise a config-only fix (Wiz technical analysis).

Active exploitation predates public disclosure. Amazon's MadPot honeypot recorded an attempt on 17 Oct 2026, four days before coordinated disclosure; watchTowr has since observed further in-the-wild activity. For normal browser users, the exposure is indirect; the fix is in the hands of site operators and hosting providers.