Six p.m. Paris time. At this time, the PHP security team will release the fix for two critical vulnerabilities in PHP. They are at the heart of the language that powers WordPress, WooCommerce, Magento and many web back offices. From then on, attackers will compare the old code and the new to reconstruct the exploit. The Dutch company Sansec therefore expects the first mass attacks a quarter of an hour later. French administrators did not need that, four days after the wave of cyberattacks of October 17.
Critical PHP vulnerabilities: what we know about CVE-2026-109618 and CVE-2026-109619
It all started Monday, October 20 in the morning, with a message on Hacker News announcing two critical PHP vulnerabilities. The post disappears, not the screenshots. One of them shows an attack tool called PHP2Shell, attributed to a certain Calif.IO. Its banner claims to work on all versions since PHP 5.4.0, released in 2012. In the afternoon, watchTowr researchers confirmed that the flaws are real and that they have reproduced the first one. However, everyone had to wait until Thursday.
The embargo, this agreement by which researchers and publishers remain silent until the correction, has therefore been shattered. That same evening, the PHP security team brought forward its release to Wednesday, October 21 at 2:00 p.m. UTC. These two critical PHP flaws are rated 9.2 out of 10 on the CVSS v4.0 severity scale. The two bugs have the numbers CVE-2026-109618 and CVE-2026-109619. These are remote code executions, or RCE. In other words, a well-formed web request is enough to make the server execute any command.
The rest is still under seal. PHP will release the versions affected by these critical flaws, and the corrected versions, with the patch. The team also reserves the right to exit earlier “if details become public or if active exploitation appears”. Huntress had not observed any attacks among its customers as of October 20. Additionally, no public exploit code has been identified, despite a short demo video posted online and then removed.
Why these critical PHP flaws affect your bitcoins
You don't code in PHP? Your money, yes. The store that accepts your USDC payments almost always runs on WooCommerce, Magento or Shopware. Likewise, your exchange's showcase site, its blog and its customer support are often based on this language.
An attacker who obtains a shell on one of these servers can overwrite the deposit address displayed at checkout. It can also inject a fake login form, or place a keylogger on the payment page. The gangs that Sansec has been tracking for years under the name Magecart won't even need phishing. Indeed, the trap will be displayed on the real domain, with the real certificate. Sansec says it bluntly: these critical flaws affect all web servers running PHP 5.4 or newer. Updating PHP is therefore the only solution, impossible to apply from the store code.
Other bad news, PHP only maintains branches 8.2 and later. A server that remains in 8.1 or 7.4 will therefore not have an official patch. You will then have to rely on a backport from the host, or migrate during the day.
PHP patch at 4 p.m., the list of things to do before
Take inventory first. Faced with these critical flaws, Huntress recommends identifying every PHP installation, including those hidden in third-party software. You must then isolate from the internet everything that is running on an end-of-life version. The CERT-EU requests the same thing in its opinion 2026-018, published Monday evening. It adds an instruction for those who will not be able to patch in time: cut exposed applications from the public network.
Then, notify your host this morning so that they can be ready at 4 p.m. If you manage your servers, block the 4 p.m.-5 p.m. slot and prepare the update command. An application firewall will not necessarily save you, because the attack would target PHP itself, before the code of your site. Finally, monitor your processes. An exploitation will be seen by a php-fpm or apache2 process which suddenly launches a shell or a curl for no reason.
CERT-FR had not published any alert on these critical PHP flaws as of 7 a.m. this Wednesday. On the other hand, its latest alerts target Ivanti Connect Secure and Citrix NetScaler, unrelated to PHP.
