PHP patches critical RCE flaws as Dutch government sites go offline

PHP released four fixed versions on October 21 as Dutch authorities temporarily took multiple government services offline as a precaution. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address two critical vulnerabilities that can allow an unauthenticated attacker to execute code on a server handling web requests.

The flaws are CVE-2026-109618 and CVE-2026-109619. PHP rates both Critical at 9.2 under CVSS v4 and says all installations serving web requests are at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Its advisory identifies mod_php as the highest-risk setup and the one where application-independent exploitation was demonstrated.

The first flaw can interrupt PHP while internal request data is only partly initialized, causing cleanup code to treat invalid data as usable. The second can leave request-specific global state in place after the underlying memory is freed, allowing a later request handled by the same worker to use stale state. PHP says the first path enables remote code execution over HTTP against mod_php; the second has documented paths against mod_php and PHP-FPM under specific conditions.

The Dutch government said the services taken offline included Overheid.nl, MijnOverheid.nl and DigiD. The Netherlands National Cyber Security Centre also temporarily disabled its website and said other public bodies and organizations had done the same. Dutch authorities said they had no signs of active exploitation at the time of the notice; that statement did not establish the status of exploitation worldwide.

OpenAI said a researcher using GPT-5.6 Sol identified one critical PHP flaw, while Wiz independently found and reported both vulnerabilities. DataPhoenix previously examined OpenAI’s account of Patch the Planet’s coordination role. PHP’s two advisories credit reporters connected to both research efforts. Wiz said its work also used Wiz Atlas and Gemini 4 Argon for discovery, exploit development, detection and patch validation.

Wiz estimates that the flaws affect 70% of the internet. That is the research company’s reach estimate, not an independently established count of vulnerable deployments; the opened research did not provide a reproducible denominator or methodology for the figure.

PHP and the Dutch NCSC say configuration changes cover only some attack paths and that installing a fixed release is the only complete remediation. Although PHP 8.1 and older are outside normal upstream support, the PHP security team also issued minimal source backports for PHP 7.4, 8.0 and 8.1 because of the severity of the flaws.