Two serious vulnerabilities have been identified in PHP, and the PHP Foundation released fixes on October 21, 2026.
A reported attempt tied to CVE-2026-109618 failed because the targeted file was absent; Cloudflare also reported attempts to bypass defenses by changing attack formats.
The available facts distinguish observed activity from confirmed compromise: no successful breaches have been evidenced.
What's happening so far?
Security companies such as Cloudflare and VulnCheck have confirmed attempts to hack from web addresses located in Canada, the Netherlands and China. So far, these moves appear to be exploratory in nature, as the attackers try to determine which websites remain exposed. In one case, the attack failed because the file they tried to hack did not exist on the system, while Cloudflare said that the perpetrators are trying to adapt the format of their attacks to bypass protection systems.
Preventive measures and treatment
To date, no successful system breaches have been confirmed. However, several organizations have chosen to temporarily take their websites offline for security reasons, pending the installation of the update released by the PHP Foundation on October 21, 2026. Organizations that have taken this measure include Pinboard, Dutch government websites, and various Wikipedia services.
If you manage websites, it is critical that you immediately upgrade your system with the official update. For those who need additional information on how to deal with the problem, the website php2shell.com has been created, which gathers relevant instructions.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
