EU Warns PHP Sites May Need Shutdowns as Critical Remote Code Execution Flaws Emerge

Due to two vital security issues in PHP runtime environment, the emergency measures have been taken by developers and security specialists. These issues present a serious threat to millions of web resources around the world. According to EU authorities, it may be necessary to shut down vulnerable resources to prevent unwanted access to them. Site administrators need to focus on applying patches as soon as possible to reduce the risk of remote code execution without authorization, before threat actors make use of them.

Emergency patches arrive October 21 as EU warns of potential site shutdowns

The PHP development team has planned to release emergency patches on October 21, 2026 at 14:00 UTC. These issues (CVE-2026-109618 and CVE-2026-109619) have CVSS v4.0 level equal to 9.2 – that means they are critical. Such high value was assigned as it is simple for malicious actors to perform arbitrary code execution on the target server without credentials.

At the moment, Cloudflare has already implemented the initial set of rules for Web Application Firewall to secure resources within their environment. These rules are focused on popular attack vectors related to vulnerabilities identified. They are available to all customers, even those on free plans. Cloudflare security experts have already noted the emergence of initial attacks and continuously improve mitigations for new vectors.

It is important to note that the vulnerability can potentially affect any PHP version starting from PHP 5 (the list of vulnerable versions hasn't been officially announced by the development team yet). Popular content management systems created with the use of PHP such as WordPress, Drupal, Joomla or Magento could also be vulnerable to these issues. Therefore, administrators of such platforms need to watch for information on patches through official sources and install them immediately after availability to ensure the security of their systems.