Threat reportVulnerabilityTL-2026-3989

PHP pre-announces two critical RCE flaws in PHP core (CVE-2026-109618, CVE-2026-109619); emergency patches due 2026-10-21 after embargo leak

criticalACTIVE

PHP pre-announces two critical RCE flaws in PHP core (TL-2026-3989) is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-20 and last reviewed 2026-10-22. It has no confirmed attribution, affects PHP Group PHP, references 2 CVEs (CVE-2026-109618, CVE-2026-109619), maps to 34 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 154 indicators of compromise.

CVSS
9.2/10Critical
CVEs
2Referenced vulnerabilities
Techniques
34MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
154Indicators of compromise

Key facts for TL-2026-3989

Threat ID
TL-2026-3989
Severity
CRITICAL
CVSS
9.2
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, government administration, finance, health, education, retail, news - media
Target regions
Global
Detection rules
9
Indicators of compromise
154
Updates
2026-10-22 · 20 updates · revalidated 20× · latest source

Malware and tooling in PHP pre-announces two critical RCE flaws in PHP core

Malware and tooling: PHP

How PHP pre-announces two critical RCE flaws in PHP core works

The PHP security team pre-announced two critical remote code execution vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by PHP, with emergency fixes scheduled for 2026-10-21 14:00 UTC. Details leaked ahead of the embargo through a since-deleted Hacker News post, and watchTowr says it reproduced CVE-2026-109618 but is withholding technical details. No in-the-wild exploitation had been reported at publication.

On 2026-10-20 the PHP project published an advance security notice on php.net stating that two critical vulnerabilities, both scored CVSS v4.0 9.2, would be fixed in a security release on Wednesday 2026-10-21 at 14:00 UTC (10:00 AM ET). The notice deliberately omits affected and fixed versions ("Full details, affected versions, and the fixed versions will be published with the release") and reserves the right to release earlier "should details of either vulnerability become public, or should evidence of active exploitation appear in the wild". The release had originally been planned for 2026-10-22.

Information about the flaws leaked before the embargo lifted via a Hacker News post (item 50167754, user petecooper, since deleted) and social-media posts. watchTowr CEO Benjamin Harris stated that both flaws are "CVSS10" in the leaked reporting (versus PHP's own 9.2) and "are understood to affect PHP versions 5, 6, 7, and 8"; watchTowr said it successfully reproduced CVE-2026-109618 but will not share technical information until patches ship. Neither the vulnerability class beyond 'remote code execution', the CWE, the attack vector, nor the trigger conditions have been disclosed. No public proof of concept, technical write-up, CISA KEV listing, or in-the-wild exploitation was reported as of 2026-10-21.

Third-party reporting (Mallory, ThreatCluster) says PHP 5.x and 7.x are end-of-life and will not receive patches, and Mallory reports the planned fixed versions as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; these version numbers are NOT confirmed by the PHP advisory and should be validated against the official release notes. Mallory's internet-exposure estimate is roughly 884,000 internet-facing hosts running PHP versions that will not be fixed (about 59% of ~1.5 million hosts reporting a PHP version): PHP 5.x 368,570 hosts, PHP 7.x 329,358 hosts, PHP 8.0-8.1 185,789 hosts, against 612,269 hosts on patchable 8.2-8.5. Because PHP underpins a very large share of web applications, exploitation of a core RCE would likely be rapid once a patch diff or write-up becomes available, so defenders should inventory PHP versions, prepare patch pipelines, and increase monitoring of web-server worker processes and web-root file writes. This record reflects pre-patch intelligence and must be updated when the official release notes publish.

MITRE ATT&CK techniques used in TL-2026-3989

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1027 Obfuscated Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Scheduled Task/Job: Cron; T1053.005 Scheduled Task/Job: Scheduled Task; T1136 Create Account; T1136.001 Create Account: Local Account; T1505.003 Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Impact

T1498 Network Denial of Service; T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1583.001 Acquire Infrastructure; T1587.004 Develop Capabilities; T1588.005 Obtain Capabilities: Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595.002 Vulnerability Scanning

Affected products and versions in PHP pre-announces two critical RCE flaws in PHP core

  • PHP Group — PHP
    Vulnerable versions: 5.x (reported, unconfirmed); 6 (reported, unconfirmed); 7.x (reported, unconfirmed); 8.x (reported, unconfirmed)
    Fixed in: To be published by PHP on 2026-10-21; unconfirmed third-party report: 8.2.35, 8.3.36, 8.4.27, 8.5.12

Remediation for PHP pre-announces two critical RCE flaws in PHP core

Patches

  • Official PHP security release scheduled 2026-10-21 14:00 UTC; affected and fixed versions to be published with the release
  • Unconfirmed third-party report of fixed versions: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (verify against official release notes)

Immediate actions

  • Inventory all internet-facing and internal PHP installations by version and deployment method (mod_php, php-fpm, containers, shared hosting)
  • Prepare an emergency patch pipeline for the 2026-10-21 14:00 UTC PHP security release and be ready for an earlier release
  • Restrict network exposure of non-essential PHP applications until patched; consider isolating internet-facing PHP apps from public networks where patching is not immediately feasible
  • Monitor php.net news and the PHP security announcements for the official affected and fixed versions

Workarounds

  • No vendor-confirmed workaround exists pre-release; limit exposure of PHP applications to trusted networks and take unsupported-version systems offline where possible

Longer-term hardening

  • Migrate PHP 5.x and 7.x systems, which are reported end-of-life and unlikely to be patched, to a supported PHP 8 branch
  • Deploy WAF and EDR rules that alert on unexpected child processes spawned by PHP/web-server workers and on new files created in web directories
  • Maintain an accurate software inventory of PHP runtime versions across hosting providers and containers

CVEs associated with PHP pre-announces two critical RCE flaws in PHP core

CVE-2026-109618, CVE-2026-109619

Weaknesses (CWE) in PHP pre-announces two critical RCE flaws in PHP core

CWE-416, CWE-787, CWE-825, CWE-755, CWE-824, CWE-1325, CWE-1419, CWE-908, CWE-843, CWE-502

Timeline of PHP pre-announces two critical RCE flaws in PHP core

Showing the 20 most recent tracked events.

  • Minimal source backports for EOL PHP 7.4, 8.0 and 8.1 are published, and Linux distributions ship pre-coordinated fixed packages.
  • PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC with advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618, OOM/longjmp corruption) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619, stale global state UAF). NVD publishes both CVEs at CVSS v4 9.2.
  • In a diary by Johannes Ullrich, SANS ISC gives the pair an aggregate CVSS of 9.4, cites Cloudflare reports of in-the-wild exploitation and public PoCs, and raises INFOCON to yellow.
  • The write-up reports lab validation on Apache prefork + mod_php (PHP 8.2.34, 8.4.4, 8.5.4; 7.x claimed) and says PHP-FPM, CGI and LiteSpeed LSAPI are not reachable. It also retracts the earlier claim that the cached-pointer rfc1867 callback path ('Bug S') is exploitable, because Z_TRY_ADDREF at session.c:3213 keeps the data alive.
  • J4ck3LSyN publishes the PHP-UP-2026 write-up on jackalsyn.com with PoC tooling (php2shell-reup.zip), before the patch. It names the root cause as a cross-request heap use-after-free in serializer state (BG(serialize)) after a memory-limit bailout during pre-RINIT session encoding, with an OOB write at ext/standard/var.c:756.
  • At 12:20 UTC Hadrian reports exploitation at scale (single-source, via The Stack coverage); Cloudflare shared no evidence on scale or success of attempts.
  • Cloudflare CTO Dane Knecht reports early attacks (~07:43 UTC) and says WAF mitigations are being updated as new vectors appear; managed rules are deployed to all plans including Free.
  • Per Sansec, a PHP core developer confirmed at about 02:13 UTC that patching is the only reliable mitigation.
  • Patchstack reports exploitation claims from multiple hosting partners (~07:34 UTC) and relays a Cloudflare report of early attacks (~07:43 UTC); watchTowr and Huntress state they have not observed exploitation. Claims are unverified.
  • Phoenix Security and others relay an unverified circulating PoC claiming CVE-2026-109618 is a heap use-after-free in the session upload-progress / multipart handling; no vendor corroboration and the PoC may be hostile tooling.
  • NVD returns no record for CVE-2026-109618 (CVEs still reserved); neither CVE is in CISA KEV.
  • Aikido, Sansec and Phoenix Security publish analyses treating all PHP versions (5.4.0+) as affected; Phoenix estimates ~2.23M internet-exposed PHP hosts, ~59% of versioned hosts on unsupported/unpatched versions. Sansec anticipates exploitation attempts within ~15 minutes of the patch release.
  • As of this date, watchTowr's FAQ states no exploitation in the wild has been reported and neither CVE is listed in CISA KEV.
  • Scheduled emergency PHP security release at 14:00 UTC (10:00 AM ET), advanced from the original 2026-10-22 plan; PHP reserves the right to release earlier if details become public or exploitation appears.
  • Symantec publishes its analysis and the Hacktool.Php2shell detection, citing honeypot telemetry of possible attempts from 2026-10-17 and coordinated attacks at scale on 2026-10-21; CISA had not confirmed exploitation at publication.
  • ELLIO observes a multipart-parser exhaustion variant (02:47 UTC), then delivery via PHP2Shell of a Mirai variant (Potassium botnet), a DDoS booter, a Go RAT and an IIS web shell, and Nuclei templates at 05:18 UTC.
  • AhnLab ASEC publishes its analysis of the php2shell repositories, warning of unverified and cloned PoCs (some demonstrate only state corruption, not RCE) and possible malware embedded in fake PoCs aimed at researchers.
  • The Register reports the PHP Foundation blaming Chainguard for breaking the embargo, and Chainguard honeypots seeing exploitation attempts from IPs in China and Russia.
  • Original planned disclosure date (11:00 AM ET) before the leak forced the release to be moved earlier.
  • Scheduled end of life for PHP 8.2. The branch gets no security fixes after this date, so 8.2.35 hosts need to move to a supported branch.

Update history for TL-2026-3989

Sources cited for PHP pre-announces two critical RCE flaws in PHP core

Detection coverage for TL-2026-3989

As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3989 across Splunk SPL, Microsoft KQL and Sigma, covering 154 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
154 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats