Mass Exploitation Attempts Target Critical PHP RCE Vulnerabilities
Two critical unauthenticated remote code execution vulnerabilities in PHP are being actively scanned and attacked by millions of attempts, with researchers already developing ASLR bypasses that could pave the way for confirmed exploitation. The fact that no successful exploitation has been confirmed yet represents a narrow window of opportunity for defenders to patch before attackers refine their techniques. Organizations running vulnerable PHP installations on internet-facing servers face severe risk, as unauthenticated RCE can lead to full system compromise, data theft, and inclusion in botnets like Mirai. This incident underscores that active scanning and exploit development often precede mass exploitation by only days or weeks, making rapid patch deployment critical.
Tactical Insight
Immediate actions
- Apply the latest PHP security patches or upgrade to a patched version immediately on all internet-facing and internal servers.
- Block or rate-limit external traffic to PHP endpoints at the WAF or perimeter firewall while patching is in progress.
- Run authenticated vulnerability scans across all assets to identify any instances of the affected PHP versions.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 24–72 hours) for critical RCE vulnerabilities on internet-exposed systems.
- Maintain a continuously updated software inventory (SBOM) that includes PHP versions across all environments to accelerate patch scope identification.
- Implement network segmentation to isolate web application servers so that a compromised host cannot freely communicate with internal systems.
Detection measures
- Deploy IDS/IPS signatures and WAF rules targeting the known exploit patterns for CVE-2026-109618 and CVE-2026-109619.
- Monitor web server and PHP error logs for anomalous request patterns indicative of scanning or exploit attempts.
- Set up alerts for unexpected outbound connections from web servers, which may signal malware delivery or C2 callback activity.