Critical PHP Zero-Day Vulnerabilities Discovered and Exploited
Story essentials
PHP Development Team, Wiz, OpenAI, Calif
Global
October 21, 2026
This page is produced by collecting and structuring multiple public reports. Sections based only on reporting or testimony affect the displayed assessment, and the page is updated when new information is identified.
About this article
COMPAMIR Editorial Team
The COMPAMIR editorial team brings together public reporting and links to the original coverage. We update the page as new information emerges.
Read our editorial policy- Earlier version 410/22/2026, 8:54:32 AM
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow full server control. The flaws affect PHP 5.4 and later, with active exploitation already detected. Patches have been released in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Earlier version 310/22/2026, 8:21:19 AM
- Earlier version 210/22/2026, 7:51:28 AM
- Earlier version 110/22/2026, 6:21:55 AM
Read next
Prioritized by shared people, places, and events.
Critical security vulnerabilities in PHP discovered
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) allow remote code execution. All PHP versions from the last 20 years are affected. Millions of exploit attempts have been observed globally.