PHP vulnerabilities prompt emergency fixes and firewall protections

Two critical PHP vulnerabilities have been tracked as CVE-2026-109618 and CVE-2026-109619. Cloudflare refers to the pair collectively as php2shell, while Palo Alto Networks has described both flaws as critical.

The PHP Foundation released fixes and upgrade guidance for the vulnerabilities on October 21, 2026. The PHP project had scheduled its security release for 14:00 UTC that day, according to information recorded by NCSC-NL.

NCSC-NL advised organizations to move to fixed PHP releases as soon as possible. Its operational information lists the same two CVE identifiers used by Cloudflare and Palo Alto Networks.

One of the vulnerabilities, CVE-2026-109619, involves remote code execution linked to stale global memory following longjmp-based error handling. Palo Alto Networks published an advisory describing how the PHP vulnerabilities affect its products.

Cloudflare enabled protections for customers using its web application firewall on October 21, 2026. The company also observed attack traffic targeting customers before the vulnerabilities’ official release.

Research and coordination before public disclosure involved Wiz, Cloudflare and other organizations. The combination of technical advisories, a coordinated PHP security release and network-level protections gives administrators several pieces of information to act on: the identifiers to check, the fixed releases to obtain and the defensive controls available through Cloudflare’s web application firewall.

The immediate next step identified by NCSC-NL is upgrading to fixed PHP releases. Organizations using products affected by the flaws can also review Palo Alto Networks’ advisory, while Cloudflare customers using its web application firewall have protections enabled for the vulnerabilities.