PHP RCE in 8.5 and Earlier: CVE-2026-109618 and CVE-2026-109619
Jonathan CranOctober 20, 20264 min read
Live updates: this post is a snapshot. For the latest on CVE-2026-109618 and CVE-2026-109619, follow the Mallory story. It updates automatically as advisories, exploits and attack activity appear.
PHP ships fixes on Wednesday, October 21 at 10:00 AM EDT for two critical remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619. Only PHP 8.2 and later get patches. Our review finds about 884,000 internet-facing hosts running an older end-of-life version.
Wed Oct 21, 10:00 AM EDT. PHP may ship earlier if details leak or attacks start
Fixed versions
8.5.12, 8.4.27, 8.3.36, 8.2.35
No fix
PHP 8.1 and earlier, all end-of-life. Affected versions go back to 2004
Exploitation
No public exploit or in-the-wild activity yet. Expect it within hours of details going public
What to do now
Find every internet-facing PHP host and record its version and SAPI (PHP-FPM, mod_php, php-cgi).
On 8.2 or later: schedule an emergency patch for the 10:00 AM EDT release.
On 8.1 or earlier: there is no patch. Upgrade to a supported branch, or restrict access (VPN, IP allowlist) or take the host offline until you can.
Ask vendors and hosting providers about appliances and managed hosting that bundle old PHP.
Prepare detection: watch for unexpected child processes of the web server and new files in web roots, and have WAF rules ready to deploy.
Where the unpatched hosts are
Of 1.5 million internet-facing hosts that report a PHP version, 59% (883,717) run a branch that will get no fix. China, South Korea and Hong Kong have the highest unpatched shares. Algeria is almost entirely PHP 5.3 on Telecom Algeria.
Share of PHP hosts that will get no fix
Hosts on PHP 8.1 or earlier, as a share of each country's hosts that report a version
<30%
30%
40%
50%
60%
70%
80%+
Fewer than 200 versioned hostsCircles: Hong Kong, Singapore, Bahrain, Maldives, Malta, Mauritius, Seychelles
Source: Shodan host counts, Oct 20, 2026. "X-Powered-By: PHP/<version>" banners, country facet.
Among countries with at least 200 versioned hosts, 19 are at 80% or higher. After Algeria and South Korea, the largest are Argentina (88%) and Ukraine (85%).
Country
PHP hosts
No fix available
Share
United States
593,489
228,770
54%
China
189,636
67,306
75%
Japan
142,213
55,460
61%
Germany
154,005
45,835
41%
Algeria
32,051
31,306
100%
Indonesia
64,371
27,774
56%
France
67,837
25,439
54%
South Korea
49,009
24,591
82%
Hong Kong
67,996
24,135
70%
India
53,578
19,847
53%
Branch
Hosts
Fix
PHP 5.x
368,570
No
PHP 7.x
329,358
No
PHP 8.0 and 8.1
185,789
No
PHP 8.2 to 8.5
612,269
Yes
PHP hosts by version branch
Internet-facing hosts that report a PHP version (1.5 million)
No fix (8.1 and earlier)
Fix scheduled (8.2 to 8.5)
PHP 5.2
23,053 (No fix (8.1 and earlier))
PHP 5.3
95,712 (No fix (8.1 and earlier))
PHP 5.4
53,878 (No fix (8.1 and earlier))
PHP 5.5
8,773 (No fix (8.1 and earlier))
PHP 5.6
187,154 (No fix (8.1 and earlier))
PHP 7.0
32,386 (No fix (8.1 and earlier))
PHP 7.1
13,993 (No fix (8.1 and earlier))
PHP 7.2
184,302 (No fix (8.1 and earlier))
PHP 7.3
29,782 (No fix (8.1 and earlier))
PHP 7.4
68,895 (No fix (8.1 and earlier))
PHP 8.0
78,955 (No fix (8.1 and earlier))
PHP 8.1
106,834 (No fix (8.1 and earlier))
PHP 8.2
224,681 (Fix scheduled (8.2 to 8.5))
PHP 8.3
241,736 (Fix scheduled (8.2 to 8.5))
PHP 8.4
84,389 (Fix scheduled (8.2 to 8.5))
PHP 8.5
61,463 (Fix scheduled (8.2 to 8.5))
Source: Shodan host counts, Oct 20, 2026. "X-Powered-By: PHP/<major.minor>" queried per branch.
PHP 5.6 and 7.2 alone account for about 371,000 hosts with no fix coming. 8.2 gets this patch, but its security support ends December 31, 2026.
Most of these hosts sit with a few providers: Amazon (over 290,000), Hostinger (142,401), Alibaba Cloud (81,078), Hetzner (51,354), DigitalOcean (47,105) and OVH (36,848). Shared hosting puts many sites on one IP, so far more websites are affected than hosts. The real count is also higher, because about 740,000 PHP hosts hide their version. Some distro packages (Debian, Ubuntu, RHEL) may backport fixes to older versions.
PHP hosts by hosting provider
All hosts that send X-Powered-By: PHP, top 10. Amazon entities combined.
Amazon
293,480
Hostinger
142,401
Alibaba Cloud
81,078
Hetzner
51,354
DigitalOcean
47,105
OVH
36,848
Telecom Algeria
28,616
One.com
24,160
Linode
23,769
Microsoft
22,412
Source: Shodan org facet, Oct 20, 2026. One IP can serve many shared-hosting sites.
Counts cover every PHP host on each network, patched branch or not. Amazon combines four Amazon network names.
What the public code shows
Before the release, we reviewed recent php-src commits and open pull requests for any hint of what the fixes cover. We found nothing that confirms either CVE. The release branches have no unreleased commits, and PHP develops embargoed fixes privately, so the two flaws are not expected to show up in public code before October 21.
Host counts: Shodan /shodan/host/count, October 20, 2026. "X-Powered-By: PHP" for the total (2,237,277) with country, org, port and city facets; "X-Powered-By: PHP/<major.minor>" once per branch from 5.2 to 8.5 for versions; http.component:"PHP" as a cross-check (1,906,831). Counts are banners Shodan has seen recently, not unique organizations.
Find the PHP hosts that won't get a fix
Mallory maps CVE-2026-109618 and CVE-2026-109619 to your attack surface and tracks exploits and attack activity as they appear.
