Zero Radar
← feed
CriticalVulnerabilityCVE-2026-109619updated 27 Oct 2026, 13:24 UTC

PHP server flaw lets attackers run code without logging in

A flaw in the PHP software that runs many websites lets an outsider send crafted requests and make the server run their commands. The attacker does not need a password, and attacks against this flaw are already happening.

Exploited (BleepingComputer, CERT-EU)Fix availableOfficial, 18 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?YesConfirmed by BleepingComputer, CERT-EU, The Record, SecurityWeek, CISA KEV, NVD · 26 Oct 2026
Fix available?YesPHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. · since 25 Oct 2026
How sure is this?Official, 18 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted request to a PHP website
  2. 2PHP mishandles memoryStale request memory is reused
  3. 3Code runs on serverAttacker commands execute remotely
  4. 4Data takenHashes and login data accessed quickly
  5. ResultAttacker controls the server

What happened

A critical memory-handling bug in PHP lets unauthenticated remote attackers run arbitrary code on the server, and can also leak memory contents or crash the service. It is one of two related critical PHP bugs (PHP2Shell) rated CVSS 9.2.

Why it is dangerous: Attackers who succeed gain control of the web server, can steal data, passwords and multi-factor login details, and move into connected systems. Any internet-facing server running PHP is at risk, and a government entity in Europe has already been hit.

Are you affected?

You are affected if your server runs an affected PHP version (8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, or 8.2 before 8.2.35, or any PHP version older than 8.2) and hosts a PHP application reachable from the internet.

PHP 8.5.x before 8.5.12; PHP 8.4.x before 8.4.27; PHP 8.3.x before 8.3.36; PHP 8.2.x before 8.2.35; all PHP versions before 8.2 (no longer supported).

What to do

  1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), or ask your web host to do so.
  2. If you cannot patch immediately, take internet-facing PHP applications offline or isolate them until the fix is applied.
  3. Follow the PHP advisory for the separate session upload progress issue (CVE-2026-115560): set session.upload_progress.enabled=0 unless you need it.
  4. Check your server and logs for unusual activity, and rotate credentials if compromise is suspected.

Timeline

  1. 20 Oct 2026, 20:32 UTC
    Publicly disclosed
  2. 20 Oct 2026, 20:32 UTC
    Reported by PHP · PHP
  3. 21 Oct 2026, 00:05 UTC
    Reported by PHP · PHP
  4. 21 Oct 2026, 00:14 UTC
    Reported by PHP · PHP
  5. 21 Oct 2026, 00:20 UTC
    Reported by PHP · PHP
  6. 21 Oct 2026, 00:24 UTC
    Reported by PHP · PHP
  7. 21 Oct 2026, 00:35 UTC
    Reported by PHP · PHP
  8. 21 Oct 2026, 10:36 UTC
    Reported by The Hacker News · The Hacker News
  9. 21 Oct 2026, 14:00 UTC
    Reported by The Hacker News · The Hacker News
  10. 21 Oct 2026, 14:17 UTC
    Reported by NVD · NVD
  11. 21 Oct 2026, 15:28 UTC
    Reported by Socket · Socket
  12. 21 Oct 2026, 15:33 UTC
    Reported by Ubuntu USN · Ubuntu USN
  13. 21 Oct 2026, 19:06 UTC
    Reported by Socket · Socket
  14. 22 Oct 2026, 06:34 UTC
    Reported by The Hacker News · The Hacker News
  15. 22 Oct 2026, 10:03 UTC
    Reported by r/netsec · r/netsec
  16. 23 Oct 2026, 07:40 UTC
    Reported by The Hacker News · The Hacker News
  17. 23 Oct 2026, 10:12 UTC
    Reported by PHP · PHP
  18. 24 Oct 2026, 22:27 UTC
    Reported by oss-security · oss-security
  19. 25 Oct 2026, 15:20 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  20. 25 Oct 2026, 15:20 UTC
    Palo Alto Networks reported on it · Palo Alto Networks
  21. 25 Oct 2026, 15:20 UTC
    CERT-EU reported on it · CERT-EU
  22. 25 Oct 2026, 15:22 UTC
    Dark Reading reported on it · Dark Reading
  23. 25 Oct 2026, 15:22 UTC
    SecurityWeek reported on it · SecurityWeek
  24. 25 Oct 2026, 15:22 UTC
    BleepingComputer reported on it · BleepingComputer
  25. 25 Oct 2026, 15:22 UTC
    r/netsec reported on it · r/netsec
  26. 25 Oct 2026, 15:22 UTC
    WordPress Security reported on it · WordPress Security
  27. 25 Oct 2026, 15:22 UTC
    CERT-EU reported on it · CERT-EU
  28. 25 Oct 2026, 15:22 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  29. 25 Oct 2026, 15:22 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  30. 25 Oct 2026, 15:24 UTC
    The Record reported on it · The Record
  31. 25 Oct 2026, 17:19 UTC
    Reported by The Hacker News · The Hacker News
  32. 26 Oct 2026, 09:19 UTC
    Reported by BleepingComputer · BleepingComputer
  33. 26 Oct 2026, 13:30 UTC
    Reported by SecurityWeek · SecurityWeek
  34. 26 Oct 2026, 23:04 UTC
    CISA reported on it · CISA
  35. 26 Oct 2026, 23:09 UTC
    CISA KEV reported on it · CISA KEV
  36. 26 Oct 2026, 23:09 UTC
    Confirmed by CISA KEV

Sources 30 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Technical details

ID
CVE-2026-109619 · ZR-ceaaccb7 · ZR-c78f9791 · ZR-3d29fe5d · ZR-f3b00a7f · ZR-6478f584 · ZR-ec0fd993 · ZR-9f968953 · ZR-27f65063 · ZR-6eda155b
CVSS
9.2 / 10
EPSS
100% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 20:32 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 13:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PHP server flaw lets attackers run code without logging in · Zero Radar