No PHP.
No impact from
these PHP flaws.

What this means for you

At w43.nl, we build websites on our own C#/.NET platform. The PHP interpreter, the software covered by this alert, does not execute our website code. This PHP update therefore does not apply to our own website or customer websites on this platform.

This statement concerns these specific PHP flaws. If you also use a third-party shop, a separate WordPress blog, a customer portal or other external software, that environment may use PHP and needs assessment by its provider. Integrations may also experience disruption if an external service temporarily goes offline as a precaution.

Unsure which environment w43.nl manages? Contact us; we can help identify the relevant provider.

What is known?

Security fixes for CVE-2026-109618 and CVE-2026-109619 are available. Both can enable remote code execution without authentication. PHP Security Team · update now.

Ask your host to install the appropriate release or a confirmed patched distribution package. PHP 8.1 and older are outside regular PHP support: ask your vendor about backports or move to a supported branch. PHP also provides minimal source backports for 7.4, 8.0 and 8.1. Official update guidance.

What has been technically confirmed?

CVE-2026-109618: memory exhaustion can leave partially initialized request data that PHP mishandles during cleanup. Code execution was demonstrated on Apache mod_php before application code runs. PHP-FPM is also susceptible, although this report describes no complete FPM exploit for this flaw. The patch changes memory-exhaustion handling. Technical advisory: OOM corruption.

CVE-2026-109619: a worker can retain references to freed memory and reuse them during a later request. The patch resets this leftover state. Exploitability depends on application and configuration; an application-dependent FPM path was also validated. Technical advisory: stale global state.

Which environments are at risk?

PHP identifies all installations serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. It assesses mod_php as the highest risk. PHP security advisory.

Why do reports mention “CVE 10”?

CVE is an identifier; CVSS measures severity. Both official advisories give CVSS v4.0 9.2: critical. The score does not indicate how many websites have been compromised. Official assessment.

Attacks and uncertainties

On 21 October, Patchstack reports receiving notifications of active exploitation from multiple hosting partners from 07:34 UTC (09:34 CEST). This is Patchstack’s report, not evidence that every PHP installation has been attacked. Patchstack.

On 20 October, Huntress had seen no exploitation in its partner environments. These sources cover different times and observations. Huntress.

The technical advisories are now public. A demonstrated research exploit is not the same as a confirmed intrusion at an organisation. The reports below describe earlier observations of exploitation.

Reports on 21 October also differ: NOS reports at 13:13 CEST that the Dutch NCSC has not observed active exploitation, and at 14:07 that the PHP Foundation reports no indication of it. This sits alongside Cloudflare and Patchstack’s reports. The extent of successful exploitation remains uncertain. NOS liveblog · 21-10-2026.

The possible consequences of code execution depend on the affected process’s permissions and server configuration. They can include access to application data, changes to files or service disruption. A vulnerability alone is not proof of a data breach.

What is Cloudflare doing?

Cloudflare CTO Dane Knecht confirms WAF rules for known attack vectors are available, including to free customers. He reports early attacks and evolving protection as new variants emerge. His message: this is temporary protection; install the PHP update. It is now available.

On 21 October, Cloudflare published emergency updates for its Cloudflare Managed Ruleset and Cloudflare Free Ruleset. The release pages consulted describe rules for unusual request patterns: blocking and logging in Managed, blocking in Free. Those notes do not explicitly name these CVEs; the connection to this PHP alert comes from Knecht’s statement. Rules may change during the day.

Check your actual settings: Knecht warns paying customers to ensure their WAF is enabled and new rules are not configured only to log. Cloudflare · WAF configuration. Logging alone does not block a request. A WAF can only inspect traffic passing through it. Having a Cloudflare subscription is therefore not, by itself, proof that a PHP environment is safe.

The impact extends beyond websites

A vulnerability can disrupt services even without a confirmed intrusion. Organisations take systems offline as a precaution, suppliers suspend services, and users temporarily lose access to information or transactions. These examples were reported or directly checked on 21 October.

More shops taken offline as a precaution

Additional check: 21 October 2026, 14:50 CEST (12:50 UTC). In addition to XXL Nutrition, these four shops displayed notices during our direct check stating that they had been taken offline preventively because of the worldwide PHP vulnerabilities:

• Spelhuis
• Onszaden
• Kitchen&More
• Halvewerk

Wimood also announces a precautionary shutdown. In an email to customers, Wimood says it is temporarily taking its website and webshop offline because of the critical PHP vulnerabilities. The announcement does not give a reopening time. Customers can still order by email and reach the company by phone. This is a precaution announced by Wimood, not a report of a confirmed breach.

All four returned HTTP 503 with CCV Shop’s explanation. CCV Shop’s own status page has reported the precautionary shutdown since 12:23 CEST. Both the storefront and shop administration tool are listed as experiencing a major outage. This illustrates how one shared platform can affect multiple shops at once; it is not a count of all affected shops or evidence of a breach. Availability may change after this check time.

Offline does not mean hacked. These examples show disruption and precautions. An unavailable public website does not establish that all underlying services, login functions or apps are unavailable too. Availability may differ by component and time.

How extensive is the damage?

These examples demonstrate effects across sectors, but the sources consulted do not provide a reliable, verified total of affected organisations, successful intrusions, downtime or financial losses. The number of websites using PHP is also not a count of vulnerable or compromised sites.

For a shop, downtime may prevent customers from ordering. For a government body, it may prevent access to information, documents or meetings. These are availability impacts even when data remains intact. Actual revenue losses or numbers of affected citizens cannot be established without figures from the organisations concerned.

What should PHP users do?

This advice concerns separate PHP environments; it is not a required action for your w43.nl website.

1. Inventory PHP. Check websites, servers, appliances and software that bundle PHP. Prioritise internet-facing systems.
2. Update now. Ask your administrator to install the appropriate patched version in the table and confirm that the web environment is actually using it.
3. Limit exposure. If a vulnerable system cannot be updated promptly, discuss temporary isolation or taking it offline with its administrator.
4. Keep checking. Monitor suspicious activity and follow security updates from vendors of products that embed PHP.

These measures follow NCSC UK guidance. After updating, ask your administrator to confirm which running PHP environment has been updated.

Huntress recommends investigating unusual processes launched by PHP. Isolate suspicious servers and preserve logs. Updating does not automatically remove existing backdoors. Huntress.

Are temporary settings enough?

No. The advisories describe settings that reduce specific attack paths, without providing a complete fix. Have your administrator assess changes to memory limits and request processing; they can also affect availability. OOM mitigations. Disabling session upload progress or PHP 8.5 fatal-error backtraces covers only specific paths; workers must be restarted. Hiding error messages does not help. Stale-state mitigations.

Frequently asked questions

Does my w43.nl website need to go offline?

No. These PHP vulnerabilities do not require our C#/.NET platform to go offline.

Should I change my password?

This PHP alert alone does not give a reason to change your w43.nl website password. Follow separate guidance if another provider reports an incident.

Is a security plugin or WAF enough?

Do not treat filtering as a replacement for a PHP update. Ask your provider what protection is demonstrated for your configuration and both vulnerabilities.

Does using no PHP make a website always safe?

No. It means these specific PHP vulnerabilities do not affect our website code. A .NET platform also requires maintenance and security updates.

Which PHP version should I install?

Use the patched release for your PHP branch in the table under What is known?. For distribution packages, ask your vendor to confirm that both CVEs have been fixed.

PHP · security release and update guidance · CVE-2026-109618 · CVE-2026-109619

Sources

• PHP Security Team
• CERT-EU · 2026-018
• NCSC UK
• watchTowr
• Huntress
• Patchstack

• Cloudflare CTO Dane Knecht
• Cloudflare · WAF configuration
• Cloudflare Managed Ruleset
• Cloudflare Free Ruleset
• NOS · 21-10-2026
• NOS liveblog · 21-10-2026
• XXL Nutrition
• DigiD
• Logius

Patch information was updated at the time shown above. Earlier news reports and shop checks remain historical snapshots; reopening has not been rechecked in this update.