Two Critical PHP Vulnerabilities Now Exploited in Real Attacks

Two critical vulnerabilities in the PHP programming language have been confirmed as actively exploited in real cyberattacks. The flaws allow remote code execution on affected servers. Security researcher Adel Karimi of Perplexity first detected the attacks using honeypots, documenting a successful breach against an Apache server running PHP 8.4.26. Marcus Hutchins of Expels later confirmed the findings, as reported by Bleeping Computer.

Both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched through emergency security updates released on October 21. However, PHP's security team has warned that a third vulnerability, CVE-2026-115560, remains unpatched. This flaw only poses a risk to systems using an uncommon combination of settings and code. Administrators are advised to disable the session.upload_progress.enabled function until further notice.